CoChat
Sign Up
PreprintCited by 1Security and Verification in ComputingAccess Control and TrustAdversarial Robustness in Machine Learning

Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents

Open access
Zhang, Yingqi·2026·arXiv
DOI 10.48550/arxiv.2606.03895arXiv 2606.03895
Open this paper in CoChat — free accountOpen PDF

Abstract

Large language model (LLM) agents can persist across tasks, acquire memory, activate Skills, synthesize tools, fork child processes, attach remote resources, and commit checkpoints as reusable images. These mechanisms expand the action surface after deployment and create authority-escalation and data-exfiltration risks when visibility is mistaken for permission. We present Agent libOS, an agent-native library OS substrate that separates three planes. Operation admission combines process identity, Task Authority ceilings, typed Capabilities, policy or Human approval, budgets, and concrete primitives. Information-flow admission propagates labels and immutable source references, resolves Host-registered Sinks, and requires an exact one-shot Human release for conditional high-sensitivity egress. Durable causal evidence records intent, outcomes, accounting, and causal links but never grants authority. Thus, the model-visible action surface may evolve without implicitly expanding resource authority or permitted information flows. The implementation provides persistent processes, Object Memory, Skills, syscall-mediated JIT Tools, images and checkpoints, typed providers, Human queues, budgets, and durable recovery. Provider-backed effects use a prepare-dispatch-settle protocol that exposes ambiguity and prevents blind replay. In source-bound evaluation, 33/33 deterministic full-runtime tasks pass both task and safety oracles. Across 12 canonical real-model runs, observed safety and strict utility are 12/12. In a paired 30-run Skill projection study, the observable-state oracle passes in all runs, with 13/15 fully correct runs in each arm. These results describe the evaluated model/provider configuration. Agent libOS does not prevent prompt injection, provide kernel-grade sandboxing, or roll back irreversible external effects.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2606.03895

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • ACRFence studies action replay and authority resurrection after agent checkpoint restore, while Agent libOS combines capability-controlled processes, parent-child lineage, ceilings, budgets, checkpoint images, restore intersection, and prepare-dispatch-settle execution.

    “ACRFence directly studies action replay and authority resurrection after agent checkpoint restore, while Agent libOS combines capability-controlled processes, parent-child lineage, ceilings, budgets, checkpoint images, restore intersection, and prepare-dispatch-settle execution [36, 39].”

    From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [36]

    Split into 2 atoms — 1 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Checkpoint replay and safe-restore work already establish the general authority-resurrection threat.

    “Checkpoint replay and safe-restore work already establish the general authority-resurrection threat [36, 39]; the rule here specializes it to a population transfer whose identity, allocation, and authorization record are fresh.”

    From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [36]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

  • AgentScope: A Flexible yet Robust Multi-Agent Platform

    Gao, D., Li, Z., Pan, X., Kuang, W., Ma, Z., Qian, B., Wei, F., Zhang, W., Xie, Y., Chen, D., et al. (2024) · arXiv · doi:10.48550/arxiv.2402.14034 · Cited by 11 · cited 1× · see citing works

    “A related line of work on tool use and agent-computer interfaces develops action representations, tool APIs, collaboration protocols, and execution loops for completing tasks across external environments [6, 10, 12, 19, 22, 24, 25, 27, 28, 30, 32, 33].”

Flagged first, then by citations

Research works printed but not linked: 60

  1. [1][1] Alexandru Agache, Marc Brooker, Andreea Florescu, Alexandra Iordache, Anthony Liguori, Rolf Neugebauer, Phil Piwonka, and Diana-Maria Popa. Firecracker: Lightweight virtualization for serverless applications. In 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20) , pages 419-434. USENIX Association, 2020. URL https://www.usenix.org/conference/ nsdi20/presentation/agache. -
  2. [2][2] Adam Bates, Dave (Jing) Tian, Kevin R. B. Butler, and Thomas Moyer. Trustworthy Whole-System provenance for the Linux kernel. In 24th USENIX Security Symposium (USENIX Security 15) , pages 319-334, Washington, D.C., August 2015. USENIX Association. ISBN 978-1-939133-11-3. URL https://www.usenix.org/ conference/usenixsecurity15/technical-sessions/presentation/bates. -
  3. [3][3] Sebastian Burckhardt, Chris Gillum, David Justo, Konstantinos Kallas, Connor McMahon, and Christopher S. Meiklejohn. Durable Functions: Semantics for stateful serverless. Proceedings of the ACM on Programming Languages , 5(OOPSLA):133:1-133:27, October 2021. doi: 10.1145/3485510. URL https://doi.org/10.1145/3485510. - · DOI
  4. [4][4] Edward Y. Chang and Longling Geng. SagaLLM: Context management, validation, and transaction guarantees for multi-agent LLM planning. Proceedings of the VLDB Endowment , 18(12):4874-4886, 2025. doi: 10.14778/3750601.3750611. URL https://doi.org/10.14778/3750601.3750611. - · DOI
  5. [5][5] Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. Securing AI agents with information-flow control, 2025. URL https://arxiv.org/ abs/2505.23643. arXiv preprint. - · arXiv
  6. [6][6] Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems , volume 37, pages 82895-82920, 2024. doi: 10.52202/079017-2636. URL https://proceedings.neurips.cc/ paper\_files/paper/2024/hash/97091a5177d8dc64b1da8bf3e1f6fb54-Abstract-Datasets\_and\_Benchmarks\_Track.html. - · DOI
  7. [7][7] Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design. In 2026 IEEE Conference on Secure and Trustworthy Machine Learning , 2026. URL https://arxiv.org/abs/2503.18813. Presented at IEEE SaTML 2026; preprint first posted in 2025. - · arXiv
  8. [8][8] Dorothy E. Denning. A lattice model of secure information flow. Communications of the ACM , 19(5):236-243, May 1976. doi: 10.1145/360051.360056. URL https: //doi.org/10.1145/360051.360056. - · DOI · Paper page
  9. [9][9] Jack B. Dennis and Earl C. Van Horn. Programming semantics for multiprogrammed computations. Communications of the ACM , 9(3):143-155, 1966. doi: 10.1145/365230.365252. URL https://doi.org/10.1145/365230.365252. - · DOI · Paper page
  10. [10][10] Dawson R. Engler, M. Frans Kaashoek, and James O'Toole. Exokernel: An operating system architecture for application-level resource management. In Proceedings of the Fifteenth ACM Symposium on Operating Systems Principles , pages 251-266. Association for Computing Machinery, 1995. doi: 10.1145/224057. 224076. URL https://doi.org/10.1145/224057.224076. - · DOI
  11. [12][12] Huan-ang Gao, Jiayi Geng, Wenyue Hua, Mengkang Hu, Xinzhe Juan, Hongzhang Liu, Shilong Liu, Jiahao Qiu, Xuan Qi, Qihan Ren, Yiran Wu, Hongru Wang, Han Xiao, Yuhang Zhou, Shaokun Zhang, Jiayi Zhang, Jinyu Xiang, Yixiong Fang, Qiwen Zhao, Dongrui Liu, Cheng Qian, Zhenhailong Wang, Minda Hu, Huazheng Wang, Qingyun Wu, Heng Ji, and Mengdi Wang. A survey of self-evolving agents: What, when, how, and where to evolve on the path to artificial super intelligence. Transactions on Machine Learning Research , 2026. ISSN 2835-8856. URL https://openreview.net/forum?id=CTr3bovS5F. -
  12. [13][13] Hector Garcia-Molina and Kenneth Salem. Sagas. In Proceedings of the 1987 ACM SIGMOD International Conference on Management of Data , SIGMOD '87, pages 249-259, New York, NY, USA, 1987. Association for Computing Machinery. ISBN 0-89791-236-5. doi: 10.1145/38713.38742. URL https://doi.org/10.1145/38713. 38742. - · DOI
  13. [14][14] Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security , AISec '23, pages 79-90. Association for Computing Machinery, 2023. doi: 10.1145/3605764.3623985. URL https://doi.org/10.1145/3605764.3623985. - · DOI · Paper page
  14. [15][15] Norman Hardy. KeyKOS architecture. ACM SIGOPS Operating Systems Review , 19(4):8-25, 1985. doi: 10.1145/858336.858337. URL https://doi.org/10.1145/858336. 858337. - · DOI
  15. [16][16] Yu He, Haozhe Zhu, Yiming Li, Shuo Shao, Hongwei Yao, Zhihao Liu, and Zhan Qin. AttriGuard: Defeating indirect prompt injection in LLM agents via causal attribution of tool invocations. In 35th USENIX Security Symposium (USENIX Security 26) , Baltimore, MD, August 2026. USENIX Association. URL https://www.usenix.org/conference/usenixsecurity26/presentation/he-yu. -
  16. [17][17] Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and Jürgen Schmidhuber. MetaGPT: Meta programming for a multi-agent collaborative framework. In The Twelfth International Conference on Learning Representations , 2024. URL https://openreview.net/forum?id=VtmBAGCN7o. -
  17. [18][18] Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R. Narasimhan. SWE-bench: Can language models resolve real-world GitHub issues? In The Twelfth International Conference on Learning Representations , 2024. URL https://openreview.net/forum?id=VTF8yNQM66. -
  18. [19][19] Collin Lee, Seo Jin Park, Ankita Kejriwal, Satoshi Matsushita, and John Ousterhout. Implementing linearizability at large scale and low latency. In Proceedings of the 25th Symposium on Operating Systems Principles , SOSP '15, pages 71-86, New York, NY, USA, 2015. Association for Computing Machinery. ISBN 978-14503-3834-9. doi: 10.1145/2815400.2815416. URL https://doi.org/10.1145/2815400. 2815416. - · DOI
  19. [20][20] Guohao Li, Hasan Abed Al Kader Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. CAMEL: Communicative agents for 'mind' exploration of large language model society. In Advances in Neural Information Processing Systems , volume 36, pages 51991-52008, 2023. doi: 10.52202/ 075280-2264. URL https://proceedings.neurips.cc/paper\_files/paper/2023/hash/ a3621ee907def47c1b952ade25c67698-Abstract-Conference.html. -
  20. [22][22] Anil Madhavapeddy, Richard Mortier, Charalampos Rotsos, David Scott, Balraj Singh, Thomas Gazagnaire, Steven Smith, Steven Hand, and Jon Crowcroft. Unikernels: Library operating systems for the cloud. In Proceedings of the 18th International Conference on Architectural Support for Programming Languages and Operating Systems , pages 461-472. Association for Computing Machinery, 2013. doi: 10.1145/2451116.2451167. URL https://doi.org/10.1145/2451116.2451167. - · DOI
  21. [23][23] Kai Mei, Xi Zhu, Wujiang Xu, Mingyu Jin, Wenyue Hua, Zelong Li, Shuyuan Xu, Ruosong Ye, Yingqiang Ge, and Yongfeng Zhang. AIOS: LLM agent operating system. In Second Conference on Language Modeling , 2025. URL https://openreview.net/forum?id=L4HHkCDz2x. -
  22. [24][24] Dirk Merkel. Docker: Lightweight Linux containers for consistent development and deployment. Linux Journal , 2014(239), 2014. URL https://www.linuxjournal.com/content/docker-lightweight-linux-containersconsistent-development-and-deployment. -
  23. [25][25] Mark Samuel Miller. Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control . PhD thesis, Johns Hopkins University, Baltimore, Maryland, USA, May 2006. URL https://jscholarship.library.jhu.edu/ handle/1774.2/873. -
  24. [28][28] Andrew C. Myers. JFlow: Practical mostly-static information flow control. In Proceedings of the 26th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages , pages 228-241. Association for Computing Machinery, 1999. doi: 10.1145/292540.292561. URL https://doi.org/10.1145/292540.292561. - · DOI
  25. [29][29] Andrew C. Myers and Barbara Liskov. A decentralized model for information flow control. In Proceedings of the Sixteenth ACM Symposium on Operating Systems Principles , pages 129-142. Association for Computing Machinery, 1997. doi: 10.1145/268998.266669. URL https://doi.org/10.1145/268998.266669. - · DOI · Paper page
  26. [30][30] Martin Odersky, Yaoyu Zhao, Yichen Xu, Oliver Bračevac, and Cao Nguyen Pham. Securing agents with tracked capabilities. In Proceedings of the ACM Conference on AI and Agentic Systems , pages 812-838. Association for Computing Machinery, 2026. doi: 10.1145/3786335.3813127. URL https://doi.org/10.1145/ 3786335.3813127. - · DOI
  27. [31][31] Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. MemGPT: Towards LLMs as operating systems, 2023. URL https://arxiv.org/abs/2310.08560. arXiv preprint. - · arXiv
  28. [32][32] Thomas Pasquier, Xueyuan Han, Mark Goldstein, Thomas Moyer, David Eyers, Margo Seltzer, and Jean Bacon. Practical Whole-System provenance capture. In Proceedings of the 2017 Symposium on Cloud Computing , SoCC '17, pages 405-418, New York, NY, USA, September 2017. Association for Computing Machinery. ISBN 978-1-4503-5028-0. doi: 10.1145/3127479.3129249. URL https://doi.org/10. 1145/3127479.3129249. - · DOI
  29. [33][33] Srinath Perera, Kaviru Hapuarachchi, Frank Leymann, and Rania Khalaf. Robust agent compensation (RAC): Teaching AI agents to compensate. In Proceedings of the ACM Conference on AI and Agentic Systems , pages 253-262. Association for Computing Machinery, 2026. doi: 10.1145/3786335.3813141. URL https: //doi.org/10.1145/3786335.3813141. - · DOI
  30. [34][34] Yujia Qin, Shihao Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, Sihan Zhao, Lauren Hong, Runchu Tian, Ruobing Xie, Jie Zhou, Mark Gerstein, Dahai Li, Zhiyuan Liu, and Maosong Sun. ToolLLM: Facilitating large language models to master 16000+ real-world APIs. In The Twelfth International Conference on Learning Representations , 2024. URL https://openreview.net/forum?id=dHng2O0Jjr. -
  31. [35][35] Jiahao Qiu, Xuan Qi, Tongcheng Zhang, Xinzhe Juan, Jiacheng Guo, Yifu Lu, Yimin Wang, Zixin Yao, Qihan Ren, Xun Jiang, Xing Zhou, Dongrui Liu, Ling Yang, Yue Wu, Kaixuan Huang, Shilong Liu, Hongru Wang, and Mengdi Wang. Alita: Generalist agent enabling scalable agentic reasoning with minimal predefinition and maximal self-evolution, 2025. URL https://arxiv.org/abs/2505.20286. arXiv preprint. - · arXiv
  32. [37][37] Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. Identifying the risks of LM agents with an LM-emulated sandbox. In The Twelfth International Conference on Learning Representations , 2024. URL https://openreview.net/forum? id=GEcwtMk1uA. -
  33. [38][38] Andrei Sabelfeld and Andrew C. Myers. Language-based information-flow security. IEEE Journal on Selected Areas in Communications , 21(1):5-19, January 2003. doi: 10.1109/JSAC.2002.806121. URL https://doi.org/10.1109/JSAC.2002. 806121. - · DOI · Paper page
  34. [39][39] Andrei Sabelfeld and David Sands. Declassification: Dimensions and principles. Journal of Computer Security , 17(5):517-548, 2009. doi: 10.3233/JCS-2009-0352. URL https://doi.org/10.3233/JCS-2009-0352. - · DOI
  35. [40][40] Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. In Advances in Neural Information Processing Systems , volume 36, pages 68539-68551, 2023. doi: 10.52202/075280-2997. URL https://proceedings.neurips.cc/paper\_files/paper/ 2023/hash/d842425e4bf79ba039352da0f658a906-Abstract-Conference.html. - · DOI · Paper page
  36. [41][41] Jonathan S. Shapiro, Jonathan M. Smith, and David J. Farber. EROS: A fast capability system. In Proceedings of the 17th ACM Symposium on Operating Systems Principles , pages 170-185. Association for Computing Machinery, 1999. doi: 10.1145/319151.319163. URL https://doi.org/10.1145/319151.319163. - · DOI
  37. [42][42] Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. Progent: Securing AI agents with privilege control, 2025. URL https://arxiv.org/abs/2504.11703. arXiv preprint, version 3 revised 14 May 2026. - · arXiv
  38. [43][43] Shoaib Ahmed Siddiqui, Radhika Gaonkar, Boris Köpf, David Krueger, Andrew Paverd, Ahmed Salem, Shruti Tople, Lukas Wutschitz, Menglin Xia, and Santiago Zanella-Béguelin. Permissive information-flow analysis for large language models. Transactions on Machine Learning Research , 2025. URL https://openreview.net/forum?id=ufYRO8y3mr. -
  39. [44][44] Tobin South, Samuele Marro, Thomas Hardjono, Robert Mahari, Cedric Deslandes Whitney, Alan Chan, and Alex Pentland. Position: AI agents need authenticated delegation. In Proceedings of the 42nd International Conference on Machine Learning , volume 267 of Proceedings of Machine Learning Research , pages 82211-82231. PMLR, 2025. URL https://proceedings.mlr.press/v267/south25a.html. -
  40. [45][45] Renan Souza, Amal Gueroudji, Stephen DeWitt, Daniel Rosendo, Tirthankar Ghosal, Robert Ross, Prasanna Balaprakash, and Rafael Ferreira da Silva. PROVAGENT: Unified provenance for tracking AI agent interactions in agentic workflows. In 2025 IEEE International Conference on eScience , pages 467-473. IEEE, September 2025. ISBN 979-8-3315-9145-8. doi: 10.1109/eScience65000.2025.00093. URL https://ieeexplore.ieee.org/document/11181558/. - · DOI
  41. [46][46] Georgios Syros, Anshuman Suri, Jacob Ginesin, Cristina Nita-Rotaru, and Alina Oprea. SAGA: A security architecture for governing AI agentic systems. In Network and Distributed System Security Symposium 2026 , San Diego, CA, USA, - [February 2026. Internet Society. ISBN 979-8-9919276-8-0. doi: 10.14722/ndss.2026. 230869. URL https://www.ndss-symposium.org/ndss-paper/saga-a-securityarchitecture-for-governing-ai-agentic-systems/.](https://www.ndss-symposium.org/ndss-paper/saga-a-security-architecture-for-governing-ai-agentic-systems/) - · DOI
  42. [47][47] Lillian Tsai and Eugene Bagdasarian. Contextual agent security: A policy for every purpose. In Proceedings of the Workshop on Hot Topics in Operating Systems , HOTOS '25, pages 8-17, New York, NY, USA, 2025. Association for Computing Machinery. ISBN 979-8-4007-1475-7. doi: 10.1145/3713082.3730378. URL https: //doi.org/10.1145/3713082.3730378. - · DOI
  43. [48][48] Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar. Voyager: An open-ended embodied agent with large language models. Transactions on Machine Learning Research , 2024. URL https://openreview.net/forum?id=ehfRiF0R3a. -
  44. [49][49] Haoyu Wang, Christopher M. Poskitt, and Jun Sun. AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents. In Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering , pages 1-12. Association for Computing Machinery, 2026. ISBN 979-8-4007-2025-3. doi: 10.1145/3744916.3764546. URL https://conf.researchr.org/details/icse-2026/icse2026-research-track/29/AgentSpec-Customizable-Runtime-Enforcement-forSafe-and-Reliable-LLM-Agents. - · DOI · Paper page
  45. [50][50] Xingyao Wang, Yangyi Chen, Lifan Yuan, Yizhe Zhang, Yunzhu Li, Hao Peng, and Heng Ji. Executable code actions elicit better LLM agents. In Proceedings of the 41st International Conference on Machine Learning , volume 235 of Proceedings of Machine Learning Research , pages 50208-50232. PMLR, 2024. URL https: //proceedings.mlr.press/v235/wang24h.html. -
  46. [51][51] Xingyao Wang, Boxuan Li, Yufan Song, Frank F. Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H. Tran, Fuqiang Li, Ren Ma, Mingzhang Zheng, Bill Qian, Yanjun Shao, Niklas Muennighoff, Yizhe Zhang, Binyuan Hui, Junyang Lin, Robert Brennan, Hao Peng, Heng Ji, and Graham Neubig. OpenHands: An open platform for AI software developers as generalist agents. In The Thirteenth International Conference on Learning Representations , 2025. URL https://openreview.net/forum?id=OJd3ayDDoF. -
  47. [52][52] Robert N. M. Watson, Jonathan Anderson, Ben Laurie, and Kris Kennaway. Capsicum: Practical capabilities for UNIX. In 19th USENIX Security Symposium (USENIX Security 10) . USENIX Association, 2010. URL https://www.usenix.org/ conference/usenixsecurity10/capsicum-practical-capabilities-unix. -
  48. [53][53] Fangzhou Wu, Ethan Cecchetti, and Chaowei Xiao. System-level defense against indirect prompt injection attacks: An information flow control perspective, 2024. URL https://arxiv.org/abs/2409.19091. arXiv preprint. - · arXiv
  49. [54][54] Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W. White, Doug Burger, and Chi Wang. AutoGen: Enabling next-gen LLM applications via multi-agent conversations. In First Conference on Language Modeling , 2024. URL https://openreview.net/forum?id=BAakY1hNKS. -
  50. [55][55] Tianbao Xie, Danyang Zhang, Jixuan Chen, Xiaochuan Li, Siheng Zhao, Ruisheng Cao, Toh Jing Hua, Zhoujun Cheng, Dongchan Shin, Fangyu Lei, Yitao Liu, Yiheng Xu, Shuyan Zhou, Silvio Savarese, Caiming Xiong, Victor Zhong, and Tao Yu. OSWorld: Benchmarking multimodal agents for open-ended tasks in real computer environments. In Advances in Neural Information Processing Systems , volume 37, pages 52040-52094, 2024. doi: 10.52202/079017-1650. URL https://proceedings.neurips.cc/ paper\_files/paper/2024/hash/5d413e48f84dc61244b6be550f1cd8f5-Abstract-Datasets\_and\_Benchmarks\_Track.html. - · DOI
  51. [56][56] John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik R. Narasimhan, and Ofir Press. SWE-agent: Agent-computer interfaces enable automated software engineering. In Advances in Neural Information Processing Systems , volume 37, pages 50528-50652, 2024. doi: 10.52202/ 079017-1601. URL https://proceedings.neurips.cc/paper\_files/paper/2024/hash/ 5a7c947568c1b1328ccc5230172e1e7c-Abstract-Conference.html. -
  52. [57][57] Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R. Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations , 2023. URL https://openreview.net/forum?id=WE\_vluYUL-X. -
  53. [58][58] Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Association for Computational Linguistics: ACL 2024 , pages 10471-10506. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.findings-acl.624. URL https://aclanthology.org/2024.findingsacl.624/. - · DOI · Paper page
  54. [59][59] Haoran Zhang, Adney Cardoza, Peter Baile Chen, Sebastian Angel, and Vincent Liu. Fault-tolerant and transactional stateful serverless workflows. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20) , pages 1187-1204. USENIX Association, November 2020. ISBN 978-1-939133-19-9. URL https://www.usenix.org/conference/osdi20/presentation/zhang-haoran. -
  55. [60][60] Jenny Zhang, Shengran Hu, Cong Lu, Robert Tjarko Lange, and Jeff Clune. Darwin Gödel Machine: Open-ended evolution of self-improving agents. In The Fourteenth International Conference on Learning Representations , 2026. URL https://openreview.net/forum?id=pUpzQZTvGY. -
  56. [61][61] Jiayi Zhang, Jinyu Xiang, Zhaoyang Yu, Fengwei Teng, Xiong-Hui Chen, Jiaqi Chen, Mingchen Zhuge, Xin Cheng, Sirui Hong, Jinlin Wang, Bingnan Zheng, Bang Liu, Yuyu Luo, and Chenglin Wu. AFlow: Automating agentic workflow generation. In The Thirteenth International Conference on Learning Representations , 2025. URL https://openreview.net/forum?id=z5uVAKwmjf. -
  57. [62][62] Boyuan Zheng, Michael Y. Fatemi, Xiaolong Jin, Zora Zhiruo Wang, Apurva Gandhi, Yueqi Song, Yu Gu, Jayanth Srinivasa, Gaowen Liu, Graham Neubig, and Yu Su. SkillWeaver: Web agents can self-improve by discovering and honing skills, 2025. URL https://arxiv.org/abs/2504.07079. arXiv preprint. - · arXiv
  58. [63][63] Yusheng Zheng, Yanpeng Hu, Tong Yu, and Andi Quinn. AgentSight: Systemlevel observability for AI agents using eBPF. In Proceedings of the 4th Workshop on Practical Adoption Challenges of ML for Systems , PACMI '25, pages 110-115, New York, NY, USA, October 2025. Association for Computing Machinery. ISBN 979-8-4007-2205-9. doi: 10.1145/3766882.3767169. URL https://doi.org/10.1145/ 3766882.3767169. - · DOI
  59. [64][64] Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. WebArena: A realistic web environment for building autonomous agents. In The Twelfth International Conference on Learning Representations , 2024. URL https://openreview.net/forum?id=oKn9c6ytLx. -
  60. [65][65] Siyuan Zhuang, Stephanie Wang, Eric Liang, Yi Cheng, and Ion Stoica. ExoFlow: A universal workflow system for Exactly-Once DAGs. In 17th USENIX Symposium on Operating Systems Design and Implementation (OSDI 23) , pages 269-286, Boston, MA, July 2023. USENIX Association. ISBN 978-1-939133-34-2. URL https://www.usenix.org/conference/osdi23/presentation/zhuang.

Cited by

Sorted by citations

Authors
Zhang, Y.
Corresponding author
Zhang, Yingqi
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2606.03895
arXiv
2606.03895
OpenAlex
W7163375171
Cited by
0
References
1
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
LLM agents, capability-based security, self-evolving agents, information flow control, data exfiltration, skills management, checkpointing, sandboxing

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review