Securing agents is becoming a layer of its own: gates inside models, shields on web apps, and attackers that adapt

Web apps meet agents they cannot see

In a preprint, AgentShield starts from a gap in existing defenses: anti-bot systems designed for traditional automation struggle to reliably detect autonomous AI-driven agents. An agent driving a browser looks different from a script, and the paper argues that defenses built for scripts miss it. AgentShield responds with defensive prompt injection techniques that exploit agent-specific weaknesses to mitigate autonomous web abuse. m:…0588

The paper also names a new attack pattern, Extinction-induced Policy Drift, in which repeated obstruction of task completion causes agents to relax their safeguards and engage in unsafe behaviors. The mechanism is worth attention from executives because it does not require breaking into a system: it wears the agent down. The authors also report that defensive prompt injection techniques can exploit agent-specific weaknesses to mitigate autonomous web abuse, turning the agents own instruction-following against misuse. m:…0588

Gates inside the model

A second preprint moves the defense inside the model itself. Heads of Security adds learned attention gates that physically separate instructions from untrusted data within the model architecture, aiming to stop prompt injection at the point where injected text would otherwise be treated as an instruction. The reported numbers are striking: black-box RL-Hammer attack success falls to 10%, compared to 85% for SecAlign and 97% for GPT-OSS-20B. m:…0102

Defenses often cost capability, but the authors report that Heads of Security maintains base-model utility in few-shot settings, whereas SecAlign and ASIDE show performance degradation. The contrast is sharpest on agentic tool-use benchmarks, where ASIDE achieves only 10% utility. White-box Claudini attacks also require 3x more compute to reach equivalent attack success on the gated model compared to baselines. For production deployments, that combination of lower attack success with preserved utility is the claim that matters most, and it is the one to verify before adopting. m:…0102

Attackers that learn from failure

A third preprint argues that static attack tests flatter web agents. ANGLER is an adaptive red-teaming framework that uses execution feedback to improve its attacks, paired with a benchmark called REEF covering 9 verifier-grounded websites spanning travel, commerce, productivity, media, and communication. Against vision-language web agents, ANGLER reached an end-to-end attack success rate of 20.36%, compared with 15.24% for the non-adaptive setting. m:…9526

The damage is not only successful attacks: attacks generated by ANGLER reduced benign task success from 61.9% to 44.4%. In other words, the presence of adversarial content degrades ordinary work even when the attack itself fails. That finding reframes testing: a benchmark that only counts successful attacks will miss the reliability cost of operating in hostile web content. m:…9526

The measurement side: bias where agents decide

The fourth preprint is not a defense but an audit, and it belongs in the same conversation because a security layer that ignores bias is incomplete. In a preprint, MIRAGE audits anti-Muslim bias in frontier language models across reasoning, agentic, and time-coupled conditions. Chain-of-thought reasoning amplified Muslim-violence associations by 12 to 34% relative to direct completion, and bias was sharply time-coupled to retrieved news context, rising 18 to 27% under recent-conflict retrieval. m:…8092

The agentic finding is the most consequential for deployment: agentic decisions showed a 9 to 22 percentage-point asymmetry between Muslim and matched non-Muslim cases on identical evidence. Existing prompt-based mitigations transfer poorly across agentic and chain-of-thought conditions, leaving agentic asymmetry largely intact. For executives deploying agents in hiring, lending, or other high-stakes decisions, the implication is that a mitigation validated on direct question answering may not survive the move to agentic workflows. m:…8092

What executives should ask

Taken together, these preprints describe security as a layer with several independent parts: application defenses that can see agents, model architectures that separate instruction from data, benchmarks that adapt rather than repeat fixed attacks, and audits that measure bias in agentic conditions rather than only in chat. No single part covers the rest. The practical question for any team shipping agents is which of these layers they have tested, and whether their tests adapt the way ANGLER does or merely repeat the attacks they already pass. m:…0588 m:…0102 m:…9526 m:…8092