← 研踪 PaperTrailarXiv:2610.06274 · v2
When the Agent Edits Its Own Limits: Evaluating a Write-Time Floor Against Prompt Prohibitions
首次提交 2026-10-05 21:07
版本更新 2026-11-09 15:20
雷达观测 2026-11-10 13:18
摘要
Many agent runtimes give the agent a tool for editing its own configuration. Some settings grant abilities, such as enabling a tool. Others set the agent's limits: where it may write, who may message it, which address it listens on, how callers authenticate, and the gate that blocks risky writes. We measure how often models widen those limits while handling ordinary requests, and how well two kinds of defence hold: a prohibition in the system prompt, in three wordings, and a check at the point of writing that we call a containment floor. Every case records whether a protected write was attempted and whether it was saved, read from the tool's arguments and from the file rather than from the model's reply. With no defence, a frontier model saved a protected value on 25 of 72 requests, often when the request never named the field. A prompt that listed the protected field names stopped every request that used those names and did not reduce writes on requests that only described the goal; a prompt that described the forbidden effects did the reverse. With the floor, 0 of 167 protected writes were saved while 65 were attempted. A single-pass pilot on two further models shows the same pattern. We draw four lessons for evaluating agent safeguards: count attempts beside outcomes, test a prompt defence with requests written in a different vocabulary from the prompt, check that a zero means the safeguard fired, and log what the harness sends to the model, because a request-ordering defect in our own runtime was invisible in the transcripts and was found again, independently, by a later benchmark.
作者备注：10 pages, 1 figure, 4 tables. Longer study: arXiv:2610.06274
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-11-09 15:20 · 最新观测版本
When the Agent Edits Its Own Limits: Evaluating a Write-Time Floor Against Prompt Prohibitions
Many agent runtimes give the agent a tool for editing its own configuration. Some settings grant abilities, such as enabling a tool. Others set the agent's limits: where it may write, who may message it, which address it listens on, how callers authenticate, and the gate that blocks risky writes. We measure how often models widen those limits while handling ordinary requests, and how well two kinds of defence hold: a prohibition in the system prompt, in three wordings, and a check at the point of writing that we call a containment floor. Every case records whether a protected write was attempted and whether it was saved, read from the tool's arguments and from the file rather than from the model's reply. With no defence, a frontier model saved a protected value on 25 of 72 requests, often when the request never named the field. A prompt that listed the protected field names stopped every request that used those names and did not reduce writes on requests that only described the goal; a prompt that described the forbidden effects did the reverse. With the floor, 0 of 167 protected writes were saved while 65 were attempted. A single-pass pilot on two further models shows the same pattern. We draw four lessons for evaluating agent safeguards: count attempts beside outcomes, test a prompt defence with requests written in a different vocabulary from the prompt, check that a zero means the safeguard fired, and log what the harness sends to the model, because a request-ordering defect in our own runtime was invisible in the transcripts and was found again, independently, by a later benchmark.
查看此版本解读 →查看此版本原文 ↗