FAILURE MODES · POLICY · EVIDENCE

Prompts are suggestions.We study what makes rules hold.

Sondera examines how agents fail, how human intent becomes enforceable policy, and how runtime evidence proves what an agent actually did.

RESEARCH PRESENTED AT

RESEARCH INDEX

PAPERS · TALKS · DEMOS · OPEN SOURCE

Research that turns intent intoa decision you can inspect.

§ICML 2026 · FLOC 2026paper

Autoformalization of Agent Instructions into Policy-as-Code

ICML AIWILD Workshop and FLoC LLM-Solve

Adam Mondl · Matthew Maisel · John H. Brock

A pipeline for translating natural-language agent instructions, tool schemas, and policy documents into checked policy before an agent acts.

Read the paper on arXiv

~UNPROMPTEDtalk

Hooking Coding Agents with the Cedar Policy Language

Matthew Maisel

A technical talk on bringing policy into the coding-agent loop so agent actions can be constrained before they complete.

Watch the talk

~BLACK HAT ARSENALtalk

GolemHalt: A Deterministic Reference Monitor for AI Coding Agents

Adam Mondl · Matthew Maisel · John H. Brock

A deterministic reference monitor for AI coding agents, built in Rust with Cedar and YARA-X. Presented live in August 2026.

View the Arsenal listing

~GRAPH THE PLANET 2026demo

Live Demo: Runtime Policy Enforcement for Coding Agents

Josh Devon · Matthew Maisel

A live demonstration for the graph and AI security community at Graph the Planet 2026, hosted at Bloomberg R&D during RSAC week.

Watch the demo

$GITHUBopen source

sondera-coding-agent-hooks

MIT license

Runtime policy hooks for coding agents, a Cedar policy engine integration, and an autoformalization skill that turns written rules into checked policy. Released alongside the GolemHalt Arsenal talk.

View on GitHub

SECURE TRAJECTORIES BLOG

Selected writing from the research team.

01 Safe Was a Policy Decision All Along OpenAI's models breached a company to cheat on a test. The scary part isn't that they broke a rule. It's that they didn't. Read 02 LLMs-as-Judges Miss Bad Behavior Context rot affects the watchers too. As an agent's run grows, the LLM monitoring it misses buried dangerous actions up to 30 times more often. Read 03 How We Hijacked a Claude Skill with an Invisible Sentence A logic-based attack bypasses both the human eyeball test and the platform's own prompt guardrails, revealing a critical flaw in today's agent security model. Read

All posts

RESEARCH AGENDA

From natural language toa checked decision.

Semantic integrity: an agent's actions carry out the intent behind them, at every step.

The open problems

Four research problems in making semantic integrity hold.

                      SEMANTIC INTEGRITY
                      four properties
                    
SOURCE AUTHORIZATION01
Who gave this instruction, and were they allowed to?
TASK ALIGNMENT02
Is this action still serving the task the user gave?
DATA ISOLATION03
Is data crossing a boundary it shouldn't?
ACTION ALIGNMENT04
Is the action about to run the action that was approved?
Contextual agent security · Siu et al., ICML 2026 →

AUTOFORMALIZATION Written rules become checked policy. Instructions written naturally, tool definitions, and requirements are transformed into policy that can be checked before an action runs.

RUNTIME ENFORCEMENT Actions meet boundaries. The security decision moves to the moment an agent asks to read, write, call a tool, or move data across a boundary. What policy can express at that moment is the open question.

TRAJECTORY EVIDENCE Behavior becomes inspectable. Agent behavior treated as a trajectory: context, tool calls, policy attributes, verdicts, and the rule path behind them.

SCALABLE OVERSIGHT Humans should not review every action. Policy, monitors, and evidence that help security teams supervise agent fleets without turning autonomy back into manual approval.