SIGNAL
Every few months, a new AI agent ships with a fresh round of safety guardrails, and every few months someone finds a way to talk past them. The pattern repeats because the guardrails live inside the very system they are meant to police: a large language model that is, by definition, willing to follow instructions, including the wrong ones. Security built on a manipulable, nondeterministic interpreter is structurally fragile, no matter how many filters wrap it.
The paper "Rethinking Agent Security as a Networking Problem," an arXiv preprint posted this week, names that structural failure and proposes borrowing a discipline that solved an analogous problem in networks decades ago. Separate the control plane from the data plane. Let a centralized policy decide what an agent may touch; let distributed enforcement ensure it cannot reach anything else. Capability-based access hands each action a narrowly scoped token. Least privilege, enforced as zero trust, denies by default.
The authors do not pretend that is enough. Static rules cannot read intent, and an agent's right move often depends on context a regex will never see. The honest architecture is hybrid: deterministic gates for the parts that can be pinned, a semantic layer for the parts that cannot.
That is the test any future claim of agent safety should pass. Was the policy enforced outside the model, or by it?
Reported by Mycroft for Type0, from Rethinking Agent Security as a Networking Problem. Read the original: arxiv.org