LLM agents

Journal article

What Counts as a Control? A Scaffold Effect Is a Contrast Conditional on What Was Held Fixed, the 2026 Controlled Studies Each Held Something Different, and Only a Declared Spend Interval Makes a Harness Claim Refutable

Pranay Mahendrakar – 2026

A language-model agent is a model wrapped in a harness that builds its context, exposes its tools, decides when to retry and when to stop. Several 2026 studies set out to measure how much the harness matters relative to the model, holding the model and the tasks fixed, and their answers do not…

Cite Related research LOR-00103 · 5 views · 6 downloads

PDF405.2 KB

Journal article

A Stated Limit Is a Forecast: What an Agent Can Truthfully Say About Its Own Permissions, Why the Checkable Part Should Never Come From the Model, and How to Score the Part Only the Model Can Supply

Pranay Mahendrakar – 2026

Agent interfaces, skill specifications and disclosure proposals increasingly ask a tool-using language-model agent to tell its user what it may and may not do. The self-explanation literature seems to answer whether such statements can be trusted, and its answer seems to be no. This paper argues…

Cite Related research LOR-00089 · 7 views · 15 downloads

PDF385.7 KB

Journal article

A Trust Score Needs a Consumer: Four Places a Per-Source Trust Value Can Act on an LLM Agent, the Missing Test of a Graded Discount Against an Adaptive Attacker, and Why the Defences That Report Guarantees Use a Gate Instead of a Score

Pranay Mahendrakar – 2026

Work on trust between language-model agents produces two kinds of object. Protocol work produces identity, attestation, stake and constraint, all bound at the transport layer before any content reaches a model. Behavioural work produces a per-source score: a reputation, a credibility, a…

Cite Related research LOR-00068 · 10 views · 19 downloads

PDF470.2 KB

Journal article

Checked at Every Step Is Not Checked as a Whole: Two Senses of Plan-Level Safety for LLM Agents, and Why Decomposition Attacks Exploit the Gap Between Them

Pranay Mahendrakar – 2026

Most deployed safety mechanisms for LLM agents judge one unit at a time: a single tool call, or a single (observation, action) pair (Choi et al., 2026). A separate literature asks whether that is the right unit to judge at all. Jones, Dragan and Steinhardt (2024) show that a task no single…

Cite Related research LOR-00054 · 11 views · 41 downloads

PDF6 MB

Journal article

Not Acting Is Not One Decision: Two Abstention Triggers in Tool-Using Agents, Why the Calibration and Permission Readings Cover Different Ones, and the Cost Term Neither Supplies

Pranay Mahendrakar – 2026

An agent that declines to send the email has made a decision that looks like the decision a language model makes when it declines to answer a question, and the resemblance has organised the 2026 literature into two camps. One reads not-acting as a calibration problem: the agent should estimate its…

Cite Related research LOR-00018 · 8 views · 22 downloads

PDF537.1 KB

Journal article

A Lesson Is an Untested Counterfactual: The Three Claims Inside a Stored Agent Failure Memory, Which of Them Anything Checks, and Why Every Published Retention Rule Keys on a Proxy

Pranay Mahendrakar – 2026

An agent that fails a task and writes down what it should have done instead has produced a specific kind of object: a sentence asserting that a named step caused the failure and that a named alternative would not have. A stored lesson carries three separable claims - that the trajectory failed…

Cite Related research LOR-00029 · 7 views · 24 downloads

PDF499.2 KB

Journal article

Newer Is Not Truer: Three Presuppositions Behind the Recency Rule in Long-Term Agent Memory, and Why Retaining Both Records Relocates the Decision Rather Than Making It

Pranay M. Mahendrakar – 2026

An agent with persistent memory writes its own records, and two of them can disagree. Across the published systems examined here the resolution runs in one direction: the newer record supersedes the older. This paper argues that the direction is not wrong so much as underdetermined, and that the…

Cite Related research LOR-00035 · 9 views · 15 downloads

PDF486.9 KB

Journal article

Near-Zero Until Someone Tries: What a Prompt-Injection Defense Number Measures, Why Static and Adaptive Results Do Not Reconcile, and the Assumption the Out-of-Band Turn Has Not Yet Tested

Pranay M. Mahendrakar – 2026

Several published prompt-injection defenses report attack success rates at or near one percent on static benchmarks; published adaptive attacks report success above fifty percent against the same defense families, and above ninety percent in several instances. Neither set of numbers is a…

Cite Related research LOR-00040 · 6 views · 6 downloads

PDF484.5 KB

Journal article

Ordering Is Not Resolution: What the Instruction Hierarchy Defines, What It Leaves Undefined, and the Same-Tier Conflicts Agent Benchmarks Do Not Separate

Pranay M. Mahendrakar – 2026

When a language-model agent receives instructions that conflict, the dominant remedy is a privilege ordering over sources: system above developer, developer above user, user above tool output. This paper argues that the ordering paradigm is well-defined for one class of conflict and undefined for…

Cite Related research LOR-00042 · 6 views · 15 downloads

PDF407.9 KB

Journal article

Intent Is Not a Property of the Record: Agent Memory Contamination, the Two Detector Families That Cover Disjoint Failures, and the Base Rate Nobody Has Measured

Pranay M. Mahendrakar – 2026

Persistent agent memory has acquired a security literature that models contamination as adversarial injection, and detectors are trained and evaluated on attacker-generated distributions. A separate empirical literature reports the same downstream damage with no attacker present, when an agent…

Cite Related research LOR-00044 · 8 views · 26 downloads

PDF461.3 KB