The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements
Quick Answer
This paper shows that Current agentic AI frameworks like LangChain, AutoGPT, and OpenAI Agents SDK lack essential safety guarantees, failing to ensure memory integrity.
Quick Take
A simulated attack on LangChain revealed an 88.9% wrongful denial rate for applicants, highlighting significant vulnerabilities in public-facing applications. Proposed containment mechanisms can mitigate these risks with minimal overhead.
Key Points
- Three frameworks audited: LangChain, AutoGPT, OpenAI Agents SDK show no compliance with safety principles.
- Memory-poisoning attacks can lead to an 88.9% wrongful denial rate in government benefit applications.
- Proposed mechanisms include a memory integrity validator and a policy gate with <0.2ms overhead.
- Current frameworks may not meet secure-by-default standards for critical public-facing systems.
- Architectural interventions are necessary for trustworthy deployment in high-stakes applications.
Paper Resources
Article Content
From source RSS / original summaryarXiv:2606. 12797v1 Announce Type: new Abstract: Agentic systems that autonomously invoke tools, maintain persistent memory, and execute multi-step plans are increasingly deployed in public-facing domains, including government services, healthcare triage, and financial advising. We ask whether the frameworks used to build these systems provide architectural-level structural safety guarantees.
Applying six containment principles derived from a compositional model of agentic architectures, we audit three dominant frameworks (LangChain, AutoGPT, and OpenAI Agents SDK) and find no native compliance in any of them. Memory integrity, a defense against one of the most prevalent vulnerability classes, is not observed in any of the three evaluated frameworks.
We validate these findings empirically: in a simulated government benefits agent built on LangChain, a single memory-poisoning write induces persistent targeted corruption across all tested seeds and backends, increasing the wrongful denial rate for targeted applicants to 88. 9%. Under a complex five-factor policy, the same attack preserves aggregate accuracy while increasing targeted wrongful denials by 3. 5x, rendering the corruption difficult to detect through standard monitoring.
We then introduce two lightweight containment mechanisms: a memory integrity validator and a policy gate, which eliminate both attack vectors with sub-millisecond overhead (<0. 2ms per call). We conclude that the current agentic framework ecosystem may not yet meet secure-by-default expectations for public-facing deployments and outline priority architectural interventions to enable trustworthy deployment in high-stakes, socially impactful applications.
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from arXiv cs.AI
See more →HOBA: Hierarchical On-Policy Bidding Agents for Adaptive Online Advertising
HOBA (Hierarchical On-policy Bidding Agents) is a novel hierarchical reinforcement learning framework that enhances online advertising bidding systems by improving adaptability and reducing hyperparameter tuning costs. It utilizes a for hyperparameter inference, a SARSA agent for expert model selection, and a dynamic expert pool for bid execution, achieving a +3.6% increase in target cost during large-scale deployment and outperforming state-of-the-art baselines on AuctionNet.