{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2609.28585", "title": "Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents", "summary": "The method replaces unfiltered carryover of tool outputs and conversation history into subsequent billable model inputs with deterministic pre-reingestion history transformation (compression or deletion) governed by four host-side invariants bounding prompt mass, context growth, recursion depth, and cumulative spend. The cost is host-runtime engineering complexity, extra logic per turn, and a quality risk: aggressive compression or deletion degrades history-dependent tasks (2/12 success under deletion versus 10–11/12 under compression). It can fail when a policy misclassifies legitimately large tool returns as attacks, when providers meter tokens in ways the invariants do not anticipate, or when an adversary distributes billable state across many small returns that individually pass the bounds.", "rationale": "Any production tool-calling agent on metered APIs is exposed to denial-of-wallet amplification through retained tool outputs, and the defenses are implementable host-side without GPUs or model changes, but the specific policies and thresholds require validation against the reader's own workloads and provider metering before adoption.", "technique": "Host-side billable-state governance for tool-calling agents", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-09-23", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2609.28585", "independent_implementations": 0, "total_implementations": 1, "stars": 7, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "The method replaces unfiltered carryover of tool outputs and conversation history into subsequent billable model inputs with deterministic pre-reingestion history transformation (compression or deletion) governed by four host-side invariants bounding prompt mass, context growth, recursion depth, and cumulative spend. The cost is host-runtime engineering complexity, extra logic per turn, and a quality risk: aggressive compression or deletion degrades history-dependent tasks (2/12 success under deletion versus 10–11/12 under compression). It can fail when a policy misclassifies legitimately large tool returns as attacks, when providers meter tokens in ways the invariants do not anticipate, or when an adversary distributes billable state across many small returns that individually pass the bounds.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.28585", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Raw history retention increases mean effective session cost by 21.2–35.9% versus governed policies; a progress-authorized history policy achieves 22/24 task successes versus 13/24 under a fixed cap, and the defense kernel contains all recurring attacks in a 123-evaluation replay corpus.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.28585", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }