Weekly signal

This week (Nov 2–10, 2026) produced several concrete, actionable signals for anyone building or governing agentic AI: a pair of defensive research papers proposing practical, deployable patterns for hardening tool-using agents; new evidence that jailbreak bundles are evolving into persistent "prompt adware" that modifies agent configurations; vendor moves to embed runtime controls at the endpoint; and vendor docs that formalize migration and safety guidance for builders. These items together push a clear message: defenses must shift off the generative model and into deterministic admission, build-time tests, runtime hooks, and endpoint/network controls.

What changed

1. SPILLWAY, a new arXiv defense, shows a practical pattern that separates "target admission" (deterministic checks on typed tool returns and delegation rules) from sanitization so that attackers cannot hide malicious targets in free text the model reads. The design yields a strong deterministic floor that prevents standard prompt-injection redirection in the authors' benchmarks.

2. AgentTrustCI (arXiv) introduces a build-time, trace-based testing framework (Java/JUnit) that encodes policy, grounding, and trajectory checks over agent traces so release pipelines can catch faulty or malicious tool selections, unauthorized parameter flows, and workflow-skipping before deployment. It treats agent behaviour as testable contracts.

3. Check Point Research published a Nov 3 analysis of the "Haiou" Codex jailbreak bundle that acts like prompt adware—installing persistent skills and modifying agent configuration so later agent responses include advertisements and altered behaviour. This demonstrates a real-world supply-chain/configuration attack against agent runtimes.

4. CrowdStrike announced new product features (Falcon Guardian / AI Kill Switch) that unify agent-level hooks, endpoint inspection, and network visibility to stop unauthorized agent actions at runtime—signaling enterprise security tooling is moving to control agent behavior outside the model. (U.S.)

5. OpenAI updated its agent-safety guidance and notes the deprecation of Agent Builder (shutdown scheduled Nov 30, 2026) while documenting concrete mitigations—structured outputs, guardrails, keeping tool approvals on, and minimizing untrusted inputs in developer messages. Builders must migrate and follow those patterns.

What to do with it

• Move critical admission checks off the model. Use typed tool returns, deterministic admission rules, and sanitizers like SPILLWAY's pattern for anything that controls money, identity, or privileged writes.
• Add build-time trace tests and CI validators that assert allowed tool sequences, grounding, and parameter values (AgentTrustCI style) before release. Integrate trace graders / deterministic replay into CI.
• Treat agent configuration files and skill packages as part of your attack surface: hash, sign, and monitor them; block untrusted jailbreak bundles; and enforce supply‑chain policies.
• For enterprises, deploy endpoint + network + agent hooks (runtime enforcement / kill switch) so you can interrupt misbehaving agents even if they run locally. Consider vendors that instrument at these control points.
• If you use Agent Builder, start migration now (shutdown Nov 30, 2026). Apply OpenAI’s practical guidance (structured outputs, guardrails, human approvals, model selection) immediately.