Problem
Research questions and friction points this paper is trying to address.
agentic AI
safety requirements
memory integrity
containment gap
public-facing systems
The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements
🤖 AI Summary
This study addresses the critical lack of architectural security guarantees in existing AI agent frameworks, which impedes their deployment in high-risk, compliance-sensitive environments. The work systematically uncovers structural security flaws in mainstream frameworks such as LangChain and introduces six containment principles grounded in compositional modeling. To enforce these principles, the authors design lightweight mechanisms that enhance memory integrity and policy-based control. Through comprehensive architecture audits, memory validation protocols, policy gating, and simulated adversarial attacks, the proposed approach demonstrates complete mitigation of key attack vectors—reducing, for instance, the false rejection rate from a single memory poisoning attack from 88.9% to zero—while incurring an average performance overhead of less than 0.2 ms.
📝 Abstract
Agentic large language model systems that autonomously invoke tools, maintain persistent memory, and execute multi-step plans are increasingly deployed in public-facing domains, including government services, healthcare triage, and financial advising. We ask whether the frameworks used to build these systems provide architectural-level structural safety guarantees. Applying six containment principles derived from a compositional model of agentic architectures, we audit three dominant frameworks (LangChain, AutoGPT, and OpenAI Agents SDK) and find no native compliance in any of them. Memory integrity, a defense against one of the most prevalent vulnerability classes, is not observed in any of the three evaluated frameworks. We validate these findings empirically: in a simulated government benefits agent built on LangChain, a single memory-poisoning write induces persistent targeted corruption across all tested seeds and backends, increasing the wrongful denial rate for targeted applicants to 88.9%. Under a complex five-factor policy, the same attack preserves aggregate accuracy while increasing targeted wrongful denials by 3.5x, rendering the corruption difficult to detect through standard monitoring. We then introduce two lightweight containment mechanisms: a memory integrity validator and a policy gate, which eliminate both attack vectors with sub-millisecond overhead (<0.2ms per call). We conclude that the current agentic framework ecosystem may not yet meet secure-by-default expectations for public-facing deployments and outline priority architectural interventions to enable trustworthy deployment in high-stakes, socially impactful applications.
Innovation
Methods, ideas, or system contributions that make the work stand out.
agentic AI safety
memory integrity
containment mechanisms
policy gate
secure-by-default
🔎 Similar Papers
No similar papers found.
