Journal article
Checked at Every Step Is Not Checked as a Whole: Two Senses of Plan-Level Safety for LLM Agents, and Why Decomposition Attacks Exploit the Gap Between Them
(c) 2026 Pranay Mahendrakar. Licensed under CC BY 4.0. Most deployed safety mechanisms for LLM agents judge one unit at a time: a single tool call, or a single (observation, action) pair (Choi et al., 2026). A separate literature asks whether that is the right unit to judge at all. Jones, Dragan…