{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2609.24130", "title": "Self-Healing Harness for Runtime Oversight of Agent Self-Modification", "summary": "The method replaces unguarded persistence of agent-authored behavioral rules (e.g., self-modified system prompts or memory writes) with an external Detect-Notice-Heal-Validate gate that grants rule changes only provisional authority until replay or forward trials show improvement on the triggering failure without regression beyond a fixed margin on protected cases. It costs additional evaluation compute per proposed change (replays, forward trials, and corpus-level re-testing of the active rule set), plus engineering to build the workspace, matched-case replay infrastructure, and regression margins, all of which run on closed-weight models and modest hardware since weights are untouched. It can fail when no matched replay evidence exists (forward trials are a weaker fallback and may admit noisy rules), when the protected-case suite under-covers the task distribution so regressions slip through, or when evaluation cost and gate latency grow with the accumulated rule corpus.", "rationale": "The gate is model-agnostic, weight-free, and compatible with API-only agents, but its benefit depends on having task-specific failure corpora and replay infrastructure that the reader must validate against their own workload before production reliance.", "technique": "Runtime admission-control gate for agent self-modification", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-09-21", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2609.24130", "independent_implementations": 1, "total_implementations": 2, "stars": 10, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "The method replaces unguarded persistence of agent-authored behavioral rules (e.g., self-modified system prompts or memory writes) with an external Detect-Notice-Heal-Validate gate that grants rule changes only provisional authority until replay or forward trials show improvement on the triggering failure without regression beyond a fixed margin on protected cases. It costs additional evaluation compute per proposed change (replays, forward trials, and corpus-level re-testing of the active rule set), plus engineering to build the workspace, matched-case replay infrastructure, and regression margins, all of which run on closed-weight models and modest hardware since weights are untouched. It can fail when no matched replay evidence exists (forward trials are a weaker fallback and may admit noisy rules), when the protected-case suite under-covers the task distribution so regressions slip through, or when evaluation cost and gate latency grow with the accumulated rule corpus.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.24130", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Task-completion score higher under the Harness in all 16 matched pairs across AppWorld, Terminal-Bench, and tau2-Bench, with two paired bootstrap intervals excluding zero; repeated-trial reliability higher in 12 pairs, tied in 4, lower in none; 55% of rejected replay-decided proposals (211/383) fixed the triggering failure while regressing a previously passing case.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.24130", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }