Agent Security, in order.

Open questions 68 open

• Agent Data Injection (ADI)4 open
  • SourceThe complete defense (CaMeL Strict) costs ~50pp of utility. Is there a fine-grained trusted/untrusted data-isolation scheme that stops ADI without the deterministic-flow-tracking utility collapse — or is the trade fundamental? Partially answered: APPA (Kravchenko et al., Archestra AI, arXiv 2607.24625, empirical) settles the "or is the trade fundamental" half and leaves the "stops ADI" half open. Its finding is a diagnosis: the collapse is not intrinsic to deterministic flow tracking, it is a property of tainting retrospectively into a single monolithic context. Once the harness can branch, a restrictive read goes to a disposable child trajectory whose label descent never reaches the parent, and the parent's downstream tools stay live — 31–50% ASR down to 0–7% at a cost of 0–26pp of episodes rather than ~50pp, and on the strongest model measured (GPT-5.6 Luna) 95% utility at 2% ASR against 92% unenforced, i.e. no cost at all. Label creep is an artifact of the data model, not a law. What stops this from retiring the question, in order of severity: (1) CaMeL Strict is never run — it is cited in a comparison table and nothing else; the only executed baseline is Fides, which the authors themselves call not feature-equivalent and whose ASR is a constant 12/42 across all four models (a policy-expressiveness mismatch, not a defeated defense). The ~50pp figure is bypassed, not refuted. (2) ADI itself is never run against it. APPA's threat model is flow between sources and sinks; a correctly-declared contract would label a forged comment author with its untrusted source, which is the right shape — but the paper's own residual breach (hide-secret-in-status, a token smuggled inside an authorized send to a legitimate reader) is exactly the flow ADI rides, and the authors state plainly that content confinement inside an authorized send is not something a label algebra over recipient sets claims to provide. (3) Vendor-authored design on a purpose-built benchmark, where most of the branching gain sits inside scenarios declared unwinnable without branching, and where the same system on a third-party benchmark (AgentDojo) costs 21–30pp — three quarters of it harness mediation overhead. So the remaining question is narrower and sharper than the original: run CaMeL Strict and a branch-confining engine on the same ADI corpus.
  • SourceRandomization is cheap and effective for key-value formats but useless for unstructured formats (Markdown, prose tool output). What protects the formats a nonce can't be attached to? (Sharpened, not answered, by Rehberger's macOS Terminal chain (case-study): its remediation — encode control characters by default at the render boundary, raw output by opt-in — is a control on unstructured text that works without any nonce, because it makes the attacker's bytes non-structural at the point of interpretation rather than fencing them at the point of authorship. But it defends the sink, not the source: it protects a renderer from an agent's output, where this question asks what protects an agent from unstructured input. The right generalization to test is whether the same move exists on the input side — a canonicalizing decoder that strips or escapes structure-bearing sequences from untrusted prose before the model reads it — which is close to the paper's own sanitization row, measured here at a large utility cost. So the answer space now has two named shapes (fence the boundary; neutralize the bytes) and neither yet has a cheap unstructured-input instance.) (A direct instance, still not an answer: Måløy's Copilot for Word disclosure (case-study, 2026-07-28) is this question's worst case in a shipping product — a .docx attachment, no key-value structure anywhere, and the concealment channel is not a delimiter but visual formatting that Copilot strips before the text reaches the model, so what the model reads is a strict superset of what the user sees. Two mitigations failed to close the class and it was still reproducing at publication. It does, however, name a third shape the answer space did not have: enforce visual parity at ingestion — give the model only what renders visibly — which is "neutralize the bytes" moved from the render boundary to the read boundary, and is deterministic and non-LLM. Untested by anyone, and it addresses only the concealment half; a visible instruction still injects.)
  • ADI was demonstrated on GPT-5.2-class agents. Does frontier model improvement reduce probabilistic-delimiter susceptibility, or does capability leave the delimiter-misreading intact (making it a durable architectural property, not a scaling-away gap)? Partially answered: Can Models Learn to Separate Instructions from Data? Durable Property vs Training Gap — capability does reduce per-boundary susceptibility (instruction injection went ~0% under hardening; newer models resist undefended static injection), so the prediction is that it lowers the trusted/untrusted-data ASR too — but never to a clean zero under an adaptive attacker, and the delimiter-misreading mechanism survives every model improvement. Still untested directly on the trusted-data boundary for the newest models — the measurement this question asks for remains open.
  • SourceDo internal/white-box monitors detect an ADI payload at all, given it is engineered to read as trusted data rather than as an attack? (Untested; the tension flagged under Connections.)
• Agent Identity and Authentication1 open
  • Hardware-bound credentials assume attested hardware everywhere agents run, including ephemeral cloud workloads and sub-agents. How does attestation work for short-lived spawned sub-agents that "have up to the same permissions as the parent"? Partially answered: AIMS specifies the credentialing and delegation mechanism — a spawned agent is just another workload that gets its own WIMSE/SPIFFE identifier and short-lived credentials (SPIFFE provisions ephemeral key material per credential), is posture-assessed at each issuance, and receives the parent's authority downscoped via OAuth Token Exchange + Transaction Tokens + cross-domain identity chaining — i.e. delegated, transaction-bound tokens, not raw inheritance of the parent's credentials (a stronger answer than "same permissions as the parent"). But AIMS dissolves rather than solves the specific hardware-attestation question: it makes hardware backing optional and replaces per-sub-agent hardware attestation with deployment-specific posture signals — so how hardware remote attestation flows to a seconds-lived sub-agent remains unaddressed (AIMS argues you don't need it).
  • ResolvedJIT + ABAC are both labeled "advanced, not easily implemented." Is there a pragmatic Enterprise-tier midpoint, or is the gap from Foundation static roles to Advanced JIT a cliff? Answered: Foundation → Enterprise → Advanced: Is the Agent Access-Control Jump a Cliff? — not a cliff; the Enterprise tier (ABAC + dynamic privilege elevation with return-to-baseline + mTLS + sandboxing) is the deliberate midpoint, and ABAC's "advanced" framing is a source inconsistency (it sits at Enterprise in the tier table). Sub-agent attestation remains open.
• Agent Identity Management System (AIMS)5 open
  • WaitNo WG consensus. This is an individual submission profiling other still-in-progress drafts (WIMSE identifier/creds/WPT/HTTP-sig, OAuth transaction-tokens, identity-chaining are all Internet-Drafts too). Which of these primitives actually reach RFC, and does the composition survive WG review? "Who governs the agent-auth protocol layer" (Agent-Native Infrastructure) is proposed (IETF/CNCF/OpenID) but not settled. Sharpened by the OpenID AuthZEN drafts: the authorization slice is being standardized in a different body from AIMS's IETF identity/delegation work — the OpenID Foundation's AuthZEN WG approved AARP + COAZ as Working Group Drafts (a step past AIMS's individual-submission status, though still pre-ratification, community-review drafts). So the governance layer is concretely plural (IETF for workload identity + delegated authority; OpenID for the authorization decision + prerequisites) and actively moving — not one arbiter but a cross-body division of labor whose eventual composition is itself unsettled. Sharpened again 2026-08-04 by a third venue that ships: MCP spec revision 2026-07-28 (mcp spec 2026 07 28 changelog, vendor-claim) legislates its own client-registration and code-redemption rules under neither body — issuer-keyed non-reusable client credentials as a MUST, RFC 9207 iss validation as a MUST, and RFC 7591 Dynamic Client Registration deprecated in favor of Client ID Metadata Documents, the same primitive §10.10 above already names under Discovery. Two things follow. The composition question gains its first concrete convergence — an independent protocol reached for CIMD without coordinating with this draft — and it also gains a fourth arbiter, one that is not a standards body deliberating but a de-facto protocol shipping requirements into implementations while IETF and OpenID are still at draft. The trigger event for this question was always ratification; the observation is that a de-facto layer may settle the primitives before ratification does. Still #oq/wait — the question is which primitives reach RFC and whether the composition survives WG review, and neither has happened.
  • SourceMission → authorization is out of scope. The hardest part — translating a natural-language mission into concrete scopes/resources safely — is explicitly deferred as a "planning step." A manipulated planning step requests over-broad authorization; AIMS gives it clean primitives but no account of securing the translation itself.
  • Mid-execution human-in-the-loop. The draft admits CIBA only models client-initiated approval and "doesn't map well" to confirmation needed mid-execution — an acknowledged specification gap. Addressed (in proposal) by the OpenID AuthZEN AARP draft: AARP generalizes CIBA's async out-of-band interaction into a general prerequisite/approval pattern — "not yet, here is what is required" — not confined to client-initiated flows and satisfiable by a person or an automated governance system mid-flow, with policy re-evaluated at enforcement. So the gap now has a proposed standards answer — but a Working Group Draft, not a ratified spec, and not yet integrated with AIMS's IETF stack.
  • NotePosture assessment is deployment-specific by design. By requiring no particular attestation mechanism, AIMS makes interoperability of trust assurance (not just protocol) unspecified: two conformant AIMS deployments can assess posture with wholly different, non-comparable signals.
  • SourceNo empirical evaluation. Unlike Out-of-Band Prompt-Injection Defense (which at least ran one adaptive reproduction), AIMS is a design document with no measured attack-resistance — its security rests on the composed specs' own (mostly non-agentic) threat models.
• Agent Supply Chain Risk2 open
  • Source"AI vendoring" as a standard response inverts decades of "don't reinvent the wheel." How is a model-reimplemented dependency itself verified and maintained — does it just relocate the risk?
  • SourceThe 250-doc backdoor persists through SFT/RLHF. What detection exists for an already-poisoned model you didn't train, short of behavioral red-teaming? Adjacent evidence (2026-07, benign analog): UBD shows the correction half is tractable for a benign training-exposure effect — it repairs benchmark memorization from the deployed checkpoint alone, using deep-ensemble uncertainty and needing neither the training data nor a clean reference model. It doesn't transfer directly (contamination inflates accuracy; a backdoor is a targeted malicious trigger that survives safety training), but it suggests ensemble-disagreement is a signal worth probing for the malicious case too.
• Agentic Prompt Injection2 open
  • NowSpotlighting and constitutional classifiers each leave a residual (2%, 5%). Stacked, what's the realistic floor, and does it hold against adaptive attackers who know both are deployed? (Partly answered by the Opus 4.8 live bug bounty: adaptive expert red-teamers still find attacks on the bare model; deployed probes add uplift but don't zero out the residual. Sharpened by AutoDojo (Ma et al. 2026): a 0% static ASR is not a floor — a cheap black-box adaptive attack, not just a white-box one, recovers 28% overall (64% on action-open tasks) against a filter that scored 0% static. So the realistic floor against a filter defense on a vulnerable model is double-digit, not zero. But the same attack barely moves ASR on newer capable base models — showing the floor is a property of the model, not the layered filter defense.) Partially answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox adds the structural half — stacking in-band layers cannot lower the adaptive floor because the layers' failures are correlated (the adaptive loop optimizes against the joint deployed stack as one surface), so the floor of any pure-friction stack is the model's own robustness; the residual that remains open is the heterogeneous stack (friction + deterministic gate attacked jointly), which no adaptive attack has yet targeted.
  • SourceWhy did Opus 4.8 regress on prompt-injection robustness relative to Opus 4.7 despite broad alignment gains — a capability/robustness tradeoff, or an artifact of harder adaptive evaluation? Partially answered: the Opus 5 card shows the regression did not persist — one generation later the same adaptive attacker drops from 7.03% to 0.56% in coding and 31.5% to 3.70% in browser use, which rules out a durable capability/robustness tradeoff on this axis. It does not explain the 4.8 dip itself; Anthropic never revisits it.
  • Resolved"LLMs cannot reliably distinguish information from instructions" — is this a fundamental property of the architecture or a training gap that future models close? The framework treats it as durable. Answered: Can Models Learn to Separate Instructions from Data? Durable Property vs Training Gap synthesizes the cluster — durable at the level that matters: any single boundary is trainable (hardening drives instruction injection to ~0%) and capability lowers per-boundary susceptibility (undefended static ASR: Claude-Haiku-4.5 0.3% vs GPT-4o-mini 58.6%), but closing one boundary relocates the attack to the next finer one, because the root cause — probabilistic reading of inexact delimiters — is architectural; "wait for the next model" lowers the number, not the mechanism, so enforce the boundary out-of-band. Partially answered (component sources): Narisetty et al. (2026) argue it is durable and cite Zverev et al. (2025) — current models don't maintain a usable instruction/data separation, and neither prompting nor fine-tuning reliably induces one. Their prescription is to stop trying to fix it inside the model and enforce control/data separation outside it (deterministic action mediation), which independently held under adaptive attack far better than in-band defenses did. Not settled (open-weight 7B, one attack, no white-box test), but the durable-property reading now has an empirical leg. Choi et al. (2026) add a sharper twist: the instruction/data boundary does look trainable (model hardening drives instruction injection to ~0%), yet the same hardened models remain 22–50% vulnerable to ADI, which forges trusted data rather than instructions. Closing one boundary just moves the attack to the next finer one, because the root cause — the LLM's probabilistic misreading of inexact structural delimiters — is architectural. So the honest answer is now "durable at the level that matters": any boundary an attacker can imitate stays porous, and the fix is again enforcement outside the model (fine-grained provenance/data-flow tracking).
• AI-Accelerated Offense2 open
  • WaitAnthropic argues LLMs benefit defenders more long-term (like fuzzers) but attackers more short-term during the transition. How long is the transition, and what determines who wins it? Partially answered (2026-07-30): Hugging Face's incident disclosure supplies one determinant the framework didn't name — access to a model that will process attack data. The attacker ran unrestricted; the defender's frontier-API forensics were refused by safety guardrails and had to fall back to a locally-run open-weight model. So during the transition, part of "who wins it" turns on whether a defender has a vetted self-hostable model in place before the incident. One vendor-reported case; it names a factor rather than dating the transition. Sharpened (2026-08-03): re-attribution shows the "attacker ran unrestricted" clause was true for a reason the original reading missed — the offending models were commercial frontier models whose vendor had deliberately reduced their cyber refusals for evaluation. The determinant is not that attackers avoid guarded models; it is that the guardrail is a switch, and during the transition it gets switched off on the offense side (legitimately, for measurement) while staying on for defenders.
  • Source"Fundamentals strong enough that scanning finds fewer bugs" assumes defenders run the scanners first. What happens to organizations that can't afford continuous model-driven scanning? Still open, and the obvious datum doesn't settle it: Hugging Face is a well-resourced AI-infrastructure company and was breached anyway — which speaks to whether scanning suffices, not to what happens to organizations that can't afford it. No source in the corpus covers the under-resourced case.
• Autonomous Defense3 open
  • Source"Measure agreement against a human for two weeks, expand if tolerable" — what agreement threshold is tolerable, and who owns the residual false-negative risk when the model dispositions an alert the human never sees?
  • SourceDefensive agents are high-value targets (compromising one yields powerful capabilities). Does concentrating detection in an Agentic SOAR create a single point of catastrophic compromise the distributed-human model didn't have?
  • SourceIf hosted-model guardrails refuse attack data, does a self-hosted forensics model become a baseline IR requirement — and how would an organization vet one in advance, given it must be capable enough for 17,000-event analysis and permissive enough to read live payloads? Partially answered (2026-08-03): the technical post-mortem specifies the bar even though it doesn't answer the baseline question — the model had to recover an XOR+compression scheme and its per-campaign key from the agent's own leaked logs, then build trace-analysis tooling, over ~17,600 actions. So "capable enough" means cryptanalysis and code generation over attacker artifacts, not summarization; and the deployed answer was a quantized open frontier MoE on the org's own endpoints (nvidia/GLM-5.2-NVFP4), which puts the hardware cost within reach of anyone already serving models. Still unanswered: whether an organization without HF's inference infrastructure can hold this posture, and what a pre-incident vetting procedure would even test.
• Autonomous Intrusion5 open
  • Source~~The guardrail asymmetry rests on one vendor's account with no named APIs and no refusal detail.~~ (The naming half is settled: HF's technical timeline names Claude Opus and Fable as the models that refused, with a screenshot of an Opus refusal. The refusal stage is still unstated.) Do frontier providers offer an incident-response exemption (enterprise terms, abuse-analysis carve-out) that would have unblocked the analysis, and if not, does one appear now that a first-party disclosure has named the problem? Partially answered (2026-08-03): OpenAI added Hugging Face to its Trusted Access for Cyber Program after the incident — an exemption mechanism exists and was granted post hoc to this victim. What is still unanswered is whether such access is obtainable by an arbitrary defender before an incident, which is the form the recommendation requires, and whether Anthropic offers an equivalent for the model actually observed refusing.
  • SourceHugging Face reports "no evidence of tampering" with public models, datasets, Spaces, or container images — the claim that separates an internal breach from an ecosystem supply-chain event. What verification supports it, and will any independent report corroborate it? No IOCs were published, so no third party can currently check. Partially answered (2026-08-03): the second first-party account is consistent with it — OpenAI describes a narrow objective (the ExploitGym answer key) and says it "has not identified any other activity at the level of severity or scale." That is a second interested party agreeing, not corroboration, and OpenAI's "platform-level compromise" wording sits awkwardly beside HF's narrower framing. Further partial answer (2026-08-03): the technical timeline names the verification — every repository the stolen source-control token could reach was reviewed for unauthorized commits, branches and workflow changes, and published container images and packages were checked against their expected digests. It also concedes more than the first disclosure did: contents:write on internal repos was real and used (a PR was opened to try to compromise CI), it just produced no change that shipped. So the negative finding now has a stated method — self-administered, with indicators redacted, so still uncheckable from outside.
  • Source"A swarm of short-lived sandboxes" with self-migrating C2 leaves few durable per-host indicators. Does agent-driven intrusion structurally break IOC-based detection and sharing, forcing detection onto behavioural and volumetric signals? Partially answered (2026-08-03): the mechanism is now observed rather than inferred, and it points the same way — each sandbox run took a fresh VPN node IP, a randomized hostname and a re-downloaded toolchain; the C2 envelope was transport-agnostic across 100+ single-use capture endpoints, pastebins, dataset commits and error-message text; payloads were XOR+gzip packed under a per-campaign key, so HF's own naive text scan of its own capture missed ~75% of the exposed secrets. And the victim's remediation moves exactly where the question predicts: behavioral-signature alerting plus flagging tokens used from unexpected origins, not indicator matching. What is not answered is the structural/industry half — HF deliberately redacted or genericized its indicators, so this source is itself an instance of IOC sharing not happening, and one victim's control choices are not evidence that indicator-based detection is broken in general.
  • WaitBoth accounts of this incident are first-party and self-interested. METR and Redwood Research have been commissioned by OpenAI to assess the model behavior observed, and will publish a joint blog covering engagement terms, scope and findings; OpenAI's own technical report is promised "in the coming weeks" after Safety and Security Committee review. Does the independent assessment confirm the attacker-side account — in particular the scoping claims that no release-track model was involved and that no comparable activity occurred elsewhere — and does an assessment commissioned and paid for by the subject count as independent? (Trigger: publication of the METR/Redwood joint blog, or OpenAI's technical report.) Partially answered (2026-08-04): a fourth organization outside the OpenAI/HF pair — JFrog — has now confirmed one link in the chain, that the sandbox escape ran through a previously-unknown zero-day in its own product rather than a deployment error, a claim its commercial interest runs against. That corroborates the escape mechanism, not the model-behavior account or either scoping claim, and JFrog is a party to the incident rather than an assessor of it.
  • SourceJFrog's "fast remediation is the new trust model" argument is offered with no elapsed time, no CVE identifier and no advisory link — only the fixed release (Artifactory 7.161), in a post whose whole subject is response speed and which names CVE publication as JFrog's standard practice. Does a CVE and a dated advisory for this vulnerability appear, and does the disclosure-to-patch interval support the claim? More generally: is model-discovered-zero-day remediation latency measurable across vendors at all, or does it stay a self-graded assertion?
• Blast Radius (Agentic)3 open
  • SourceThe framework prefers identity-based isolation over network segmentation, but most enterprises have heavy segmentation investment. What's the migration path, and does dual-running create new gaps? Partially answered (2026-08-03) by Hugging Face's post-mortem (case-study, first-party) — the first deployed evidence in the corpus, and it answers the gap half more clearly than the path half. The breach ran straight through the dual-running seam: a service-connector credential that was one credential for all clusters, bound to system:masters, i.e. authority derived from reaching the broker rather than from being a named caller — a segmentation-era pattern surviving inside a Kubernetes estate. The remediation is the migration in miniature (workload identity where it was absent, per-cluster connector credentials, pod-level IMDS blocking), so the direction is confirmed. What is still missing is the thing the question asks for: HF describes this as incident remediation, not as a program, and says nothing about sequencing, cost, or what broke during the cutover. One organization, under duress, after a breach.
  • SourceMulti-agent compartmentalization increases the number of identities to manage; at what point does identity-management overhead create its own attack surface?
  • SourceDoes inter-agent propagation need containment distinct from per-agent containment? The isolation taxonomy's agent–agent boundary is the one this vault has no page for, and its claim there is specific enough to be wrong: that topology — network structure, routing rules, shared memory — not per-agent authority, decides whether one compromise stays local or goes systemic, and that memory partitioning and topology-aware monitoring are therefore more durable than tighter per-agent scoping. If that holds, an estate whose agents each pass every control on this page (scoped tools, per-call authorization, isolated memory, unique identity) can still cascade, and per-agent containment is the wrong denominator. Nothing in the corpus measures a multi-agent cascade under per-agent controls; the survey asserts it from the attack literature and measures nothing.
• Capability Gating Is Not Authorization4 open
  • SourceThe 0/48 static and 0/29 adaptive results are suite- and budget-bounded (40 iterations, a GLM-5.2 attacker, one author's vector corpus). Does the deterministic gate hold under longer adaptive budgets, stateful side channels (DNS rebinding, timing), or multi-agent policy-poisoning — the future work the paper names? Partially answered on the suite half only: NetInjectBench (arXiv 2607.10490, empirical) runs an independently-constructed 80-scenario attack corpus in a different domain (network operations), by a different group, on three different models, and its metadata-aware gate also reaches 0 unsafe actions (0/240 model-scenario instances, 95% Wilson upper bound 1.58%) — plus 100/100 correct decisions on a 90-instance degraded-metadata stress suite. So the zero is not an artifact of one author's vector corpus. The budget half is untouched: that attacker is entirely static (fixed scenarios, temperature 0, no optimizer, no defense-aware adaptation), so it corroborates the 0/48 static suite and says nothing about the 0/29 adaptive run.
  • SourceThe authz allowlist stops value-redirection but not corruption of legitimately-variable data. Is there a per-call scheme that constrains free-text / open-ended arguments without collapsing utility — or is that irreducibly the province of provenance/data-flow tracking (CaMeL Strict, at ~50pp utility cost)? Partially answered on the parenthetical only: APPA (arXiv 2607.24625, empirical) shows the ~50pp is not intrinsic to flow tracking — branching a restrictive read into an isolated child trajectory instead of tainting the parent recovers most of it (0–26pp of episodes, and zero on the strongest model measured). So "irreducibly the province of provenance tracking" no longer implies "irreducibly expensive." The residual itself is untouched and reproduced a third time: APPA's own hide-secret-in-status breach is a secret smuggled inside an authorized send to an authorized reader, and the authors state that content confinement inside a permitted flow "a label algebra over recipient sets does not claim to provide" — the same class that survives Progent at 22.2% and this page's authz stage. Three independent architectures now stop at the same wall.
  • WaitThe deployment-tier ~3.2× exposure gap (0.603 vs 0.189) means the cheap models chosen for high-volume agent traffic are the most likely to emit the unauthorized call — exactly where a per-call gate is most load-bearing. Does model improvement shrink the attempt rate enough that the gate becomes optional, or is the gate the durable control while models stay jagged? Partially answered: on a different surface — payloads planted in agent memory files rather than model-emitted arguments — Bad Memory (arXiv 2607.14611, empirical) finds capability does not order the exposure: mean ASR falls with strength inside the Claude family (Haiku 4.5 63.3% → Opus 4.7 30.0%) and rises with it inside the Codex family (GPT-5.2 23.3% → GPT-5.5 60.0%), with the strongest Codex model at 100% ASR on the subtlest goal. Worse for the "gate becomes optional" reading: the most resistant model measured (Opus, 18.3% mean ASR under chaining) is also the most likely to leave the payload in place for a weaker successor (93.3% persistence), so improvement at the top can raise rather than lower system-level exposure. Not a direct answer — this measures neither the paper's frameworks nor unauthorized-argument emission — but it is evidence against tier-based reasoning generally.
  • SourceOut-of-band policy is load-bearing but under-specified for authoring at scale. The paper forbids any model-sourced policy element; who authors and maintains the verified sets, ceilings, and allowlists for a large tool surface, and does that authoring burden cap the control to high-stakes (money-moving) tools? Partially answered, twice, with opposite answers. APPA (Archestra AI, arXiv 2607.24625, empirical) supplies a third policy shape: not a central verified set, but a per-tool declared contract — each tool states its own label delta, its emits effect tokens, and its requires preconditions, and the engine composes them through a lattice fold whose associativity and commutativity are proven rather than tested. Distributing authorship to the tool definition is the answer that plausibly scales, since a tool surface grows one tool at a time. But APPA also supplies the first measured failure of exactly this burden, and it is the sharper data point: in the authors' own evaluation a create_finance tool declared with no sink requirement opened a store-mediated laundering path — write an HR value into finance, read it back under the finance contract — and the paper concedes "prospective enforcement is only as complete as the contracts it evaluates." So the burden does not disappear when you distribute it; it becomes a coverage problem (is every write-side tool declared?) instead of a maintenance problem, and it failed on a fourteen-scenario benchmark with seventeen tools. NetInjectBench's answer runs the other way: in an operations setting nobody authors it — the change-management system already holds it. Its six trusted fields (approval status, maintenance window, approved tool, approved device, approved patch, change-request ID) are the schema of an existing ITSM/CMDB record, so the gate consumes an out-of-band channel the enterprise maintains for its own reasons. That reframes the burden as integration rather than authoring, and suggests the answer is domain-shaped: where a change-control system of record already exists, policy is free; where it does not, the authoring problem stands. Weak as evidence — the benchmark governs two tools, so it never encounters the scale the question is about, and the record is a benchmark field rather than a live system. Escalated, not answered, 2026-08-04: Rashidi's SoK (balkanization execution security research, empirical) makes this its Gap 4 and finds the field-wide absence — Datalog reference monitors, capability tokens, deterministic pre-action gates, information-flow graphs, "every one of them assumes the policy itself is correctly specified by a trustworthy author and asks only whether that policy is then enforced. None studies what happens when the policy is wrong, overly permissive by mistake, internally contradictory, or where a policy author under time pressure grants broader scope than intended because narrower scoping is more work." So the question is not under-answered in this vault by accident; no paper in a 39-paper execution-security corpus measures it. The survey rates it the most consequential of its first four gaps and supplies the argument for why: ShellSieve's 69–98% fragility is measured against denylists real developers wrote and shipped, so policy-authoring error is plausibly at least as large a source of real-world risk as enforcement failure — and it is the one stage of the pipeline nobody measures. The experiment it asks for is well-specified: a ShellSieve-style empirical study aimed at the access-control policies this literature proposes rather than at command denylists, to tell the field whether its mechanisms are undermined more by weak enforcement or by policies never correctly specified. Note this also outranks the two partial answers above: APPA's undeclared-create_finance-contract breach is an instance of policy-authoring error caught in the wild, which the survey's framing predicts should be common and unmeasured.
• Impossible, Not Tedious (Design Test)1 open
  • NowSome controls are friction for humans but barriers for agents (or vice versa). Is the test agent-relative, and how do you evaluate it for mixed human/agent threat models? Partially answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — yes, but the relativity is to the adversary's cost curve and position, not human-vs-agent per se: "impossible" controls are actor-invariant, "tedious" ones are priced per adversary class (the ADI confirmation dialog is friction pointed at the wrong party; aiAuthZ's identity gate is a barrier against a different principal, friction under the owner's own authority). Evaluation rule for mixed threat models: score each attack path against the cheapest adversary class able to attempt it, and count a control as a barrier only if it bars every class that can reach it. Residual: no source yet measures a mixed human/agent deployment.
  • ResolvedDefense-in-depth traditionally stacks friction controls on the theory that enough of them sum to a barrier. Does this test invalidate layered friction, or just demote it below capability-removal? Answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — demote, with a mechanism: friction layers fail jointly under an adaptive attacker who optimizes against the deployed stack as one surface (AutoDojo's loop specializes against the live defense without identifying it; Nasr et al. broke twelve in-band defenses at >90% together), so the independence assumption behind sum-to-barrier arithmetic is false and the adaptive floor of a pure-friction stack is set by the model, not the layer count. Friction survives as residual-reduction in front of at least one capability-removing gate (Opus 5's probes+classifier two-layer architecture), never as a substitute for one.
• Least Agency1 open
  • Dynamic privilege elevation (Enterprise) reintroduces an elevation path; how is the elevation request itself authenticated against a manipulated agent? Partially answered: aiAuthZ (Kodathala, arXiv 2607.05518) moves the decision off-host and binds a tool call's authority to a per-message HMAC-signed human turn, not to what the agent asserts — so "the message body can claim anything, including that an owner approved the action, but the bound identity is cryptographic and the claim confers nothing." Measured: it blocks the 5 identity-spoofing cases (a non-owner claiming owner authority) that an argument-only policy can't distinguish from legitimate owner use (9/9 vs 4/9). The residual it does not close: an elevation firing under the active owner's own authority — bounded only by argument/rate policy, the same corrupt-legitimately-variable-data limit every value gate shares. Caveat: a single-author preprint.
  • ResolvedLeast agency adds a frequency dimension ("how often"), but the framework also says rate limits are friction, not barriers (Impossible, Not Tedious (Design Test)). How is frequency-limiting both a least-agency control and a friction-only one — context-dependent? Answered: Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox — the paradox dissolves on mechanism, not context: a resettable rate (N-per-minute throttle) is friction an unlimited-patience attacker outwaits, while a cardinality bound tied to an out-of-band authorization event (AIMS transaction tokens with frequency = 1, aiAuthZ single-use nonces, ScopeGate's fail-closed idempotency/ceiling stages, the framework's own expiring tokens — "the window closes, not just narrows") is capability removal: the (N+1)th action is unauthorized, not slower. Frequency-limiting is a barrier exactly when the counter lives outside the agent's trust domain, exhaustion denies rather than delays, and the reset is a fresh authorization event rather than the passage of time.
• MCP Tool Poisoning4 open
  • SourceCross-tool / stateful detection. Information-theoretic secrecy defeats per-tool scanning by construction. Is there a detector that reasons over the aggregate of a server's tool set (and its update diff history) to spot the share pattern — and can it do so without an infeasible combinatorial search over t-subsets? Partially enabled (not answered) by MCP 2026-07-28: the update-diff-history half now has protocol support — required ttlMs/cacheScope mean a conforming client holds the previously-vetted list, deterministic tools/list ordering makes the diff clean, and toolsListChanged/TTL expiry date the refresh. That supplies the input a stateful detector needs and nothing about the detector: the secrecy result is indifferent to when a share is scanned, so the aggregate-reasoning problem is exactly as open as it was.
  • SourceAutomating the attack chain. The reconstruction-trigger prompt engineering still relies on manual effort; the authors flag feedback-driven prompt optimization (à la AutoDojo) as the next escalation. How much does automation raise ASR against aligned models?
  • SourceDoes a strict-access-control agent architecture close it? The authors note agents with fine-grained interaction / strict access control can force user consent and expose the attack — but "the majority of users lacking safety awareness opt for auto-approval," reopening the convenience-vs-security trade. Where does the realistic equilibrium sit?
  • SourceIndependent replication of the malicious-data-via-legit-server branch. Tenet's Agentjacking figures (2,388 orgs, 85% success, a $250B victim) are vendor-reported from controlled testing, not independently measured — and the branch is now known to be plaintext trusted-server data relay, not fragmentation/rug-pull (resolved above). How prevalent is this branch beyond Sentry — any observability / ticketing / log / CI MCP that relays externally-influenced data as trusted output — and does an independent measurement confirm the ~85% agent-execution rate on current models?
• Memory and Context Poisoning4 open
  • SourceLong-term memory drift is defined as undetectable per-change. Drift detection requires a baseline — but if the baseline itself drifts (Advanced "continuous baseline refinement"), how is a slow poisoning attack distinguished from legitimate evolution? Partially answered: bad memory measures the preference-vs-planted-directive boundary directly (its brand-targeting goal is designed as the ambiguous case, "where the agent has the least signal to distinguish the two") and finds no reliable in-model discrimination: ASR spans the entire range across four current models (Opus 0%, Haiku 10%, GPT-5.2 40%, GPT-5.5 100%), and among the models that did recognize it, the weaker two removed the rule while the strongest recognized it and left it in place. So the discrimination problem is worse than a drifting-baseline problem in shipping systems: nothing compares against a baseline at all — an auto-loaded file is read as authoritative on sight. The original question (how a detector should separate slow poisoning from legitimate refinement) remains open — and ghostwriter memory poisoning narrows the space of answers: its descriptive payloads are exactly the ambiguous case in the update channel (a polite "note the new address" email, formally indistinguishable from the deadline-change and contact-update emails the benign workweek is made of), and they evade a trained detector completely (DataFilter 0%) and a prompt-only judge 94% of the time, because the only signal those judges have is authoritative tone.
  • SourceThe write-resistance half of the finding rests on a footnote, not a measurement — preliminary attempts that "do not trivially succeed." Does a systematic attack on the write path fail against an agent explicitly configured for aggressive self-maintenance (as Bad Memory's own baseline behaviors.md is), or did the preliminary attempt simply not push hard enough? Partially answered: ghostwriter memory poisoning is that systematic write-path attack, and on framework-managed memory stores it succeeds at ~98% across five agents and four models from a single inbound email — because those stores retain every interaction and have no admission control to resist with. What stays open is the narrower question the footnote actually concerns: whether the workspace-file substrate (an agent deciding, by tool call, to edit CLAUDE.md) resists a comparably systematic attack. Nobody has measured that.
  • SourceDoes a model-based memory gate survive an adaptive attacker? AM-Sentry's residual is 12–20% against attackers unaware of it, and its origin/source-trust scores are inferred by an LLM from message content while the paper's own threat model gives internal adversaries the org knowledge to read as internal (V = t × (1 − o) collapses as apparent origin rises). Does the residual explode once the attacker optimizes against the checklist — and does the alternative, binding origin at write time from the authenticated channel, stay at 0% on this attack's substrate? Not answered, and the gap widened: memsecbench evaluates no defense at all, and its own 310-case corpus is authored ahead of time and replayed unchanged across all 24 configurations — so the corpus's largest memory-security measurement is also non-adaptive. Every attack and every defense number on this page now rests on a static attacker.
  • SourceIs refusal-without-removal a defect or the right default? Never editing a user's files unasked is defensible policy; leaving a recognized injection in the highest-authority file for the next session to load is not. Would a product change that lets the agent quarantine or annotate flagged memory lines (rather than delete or ignore) cut downstream ASR without raising false removal of legitimate preferences? Partially answered: memsecbench prices the obvious alternative — "ask the agent to clean it up later" — and finds it is not free. Under an explicit repair prompt, removal succeeds 86.3% of the time but selective removal only 56.1%, because benign-memory preservation fails in 30.2 points' worth of otherwise-successful repairs. So the deferred-remediation default carries a measured collateral-damage cost, and quarantine-or-annotate is attractive precisely because it decouples neutralization from deletion. The original question stays open, and is now sharper — this is the 2026-07-30 promote-trigger, narrowed. MemSecBench brackets the target quantity without measuring it: W2 persistence is unconditional on detection, E2 records detection-and-refusal on a branch that never inspects the store, and F1 is repair when prompted. What is still needed is a joint, same-run measurement — of the cases where the agent recognized the payload and declined to act, what fraction of stores still contained it at end of session with no repair prompt issued.
  • ResolvedIntegrity hashing detects modification but not malicious-but-valid memory written through a legitimate (injected) interaction. What catches semantically-poisoned-but-cryptographically-intact memory? Answered: Bind, Don't Forbid; Prevent, Don't Detect: The Action-Open and Poisoned-Memory Residuals — nothing catches it, provably: the malicious-but-valid class is exactly a laundering attack (TMA-NM, Louck, arXiv 2606.24322), and a machine-checked separation theorem (T1) proves no content- or lineage-based detector is sound against it; content-judge sweeps confirm no threshold reaches 0% ASR at full utility. The question's premise (detect it) retires in favor of prevention by construction: bind each item's authority-to-act to its true origin at write time, non-malleably, so a laundered item is act=none however benign it reads — 0% attack-success across 8 frontier models at 100% legit-utility vs up to 68% for content/lineage baselines. Integrity hashing keeps its real job (tamper detection, forensics, rollback); the semantic-poisoning defense is authority architecture, not inspection. Residuals (retrieval-to-text path, corroborator availability, value-level taint) are tracked on the TMA-NM page's own open questions.
• Non-Malleable Memory Authority (TMA-NM)5 open
  • SourceThe full guarantee is machine-checked on a bounded model + a machine-checked inductive invariant, not a fully mechanized unbounded deductive proof (TLAPS/Lean). Does the unbounded theorem hold once mechanized for arbitrary slots, sessions, and thresholds — the future work the inductive invariant sets up?
  • SourceValue attribution in a black box. The headline results set origin by channel (not text-matched), but a real deployment attributing which retrieved value the agent used needs value-level taint propagation through nested structured payloads. Is a capability-token design (authority as an unforgeable token flowing with sub-values) enough, or does implicit/aggregate reconstruction — assembling a security-relevant value from several low-integrity fragments by in-context reasoning — leave a residual gap the boundary monitor can't taint?
  • SourceCorroborator availability in the wild. How often do two genuinely independent trusted sources exist for routine actions? The uncorr-auto fallback converts missing corroboration into a one-time user confirmation — but at scale that reintroduces the approval-fatigue surface the out-of-band literature flags for in-the-loop tasks. Which untrusted-sourced actions can be corroborated without a human, and which are stuck asking?
  • SourceAnswer-bias is still open. TMA-NM by design does not touch non-consequential answer-biasing (surfaced with provenance). As agents produce more text people act on, is the retrieval-to-text path — not just retrieval-to-action — the next thing that needs an integrity guarantee?
  • SourceCross-agent memory is out of scope. Extending origin-bound authority across a federation of origin authorities (the multi-agent / A2A case) is named as a natural next step; does non-malleability compose across agents, or does the inter-agent channel reopen the laundering surface?
• Off-Host, Identity-Bound Authorization4 open
  • SourceThe trust-boundary premium is unmeasured. aiAuthZ argues off-host beats in-process, but its own comparison is only against argument-only / delegation-token ablations, not a matched-utility head-to-head vs CaMeL or Progent. Does the separate trust domain buy measurable security beyond the shared argument policy — the author's named next step, and the crux the single-author-preprint caveat should keep open?
  • SourceWho authors the policy at scale? Like ScopeGate, the off-host policy (role allowlists, path/URL/recipient constraints, ceilings) is operator-authored and out-of-band. The same authoring-burden question applies: does maintaining verified sets for a large tool surface cap the control to high-stakes tools?
  • SourceThe non-repudiation gap. Symmetric HMAC gives operator-facing authenticity but no third-party non-repudiation; is the proposed asymmetric mode deployable at the microsecond latencies that make the gateway attractive, or does key management erode the cost advantage?
  • SourceThe active-user residual. Per-message identity is decisive only when the attacker is a different principal. An injection firing under the active owner's own authority is bounded only by argument/rate policy — the same limit as every value gate. What closes that half beyond provenance/data-flow tracking (CaMeL Strict)?
• Out-of-Band Prompt-Injection Defense6 open
  • SourceThe reproduction bounds a single black-box attack template on one weak model. Does a stronger optimized white-box (GCG) attack, or one confined to already-authorized actions (achieving the injection goal without any policy violation), break the deterministic gate the way adaptive attacks broke in-band defenses? The authors name this as the next study. (The "already-authorized actions" half is now partly addressed by Mellafe Zuvic (2026): it splits "already authorized" into capability-authorized-but-not-value-authorized (a well-typed account=acct_ATTACKER — blocked by ScopeGate's per-call value authz stage, 0 bypasses in-corpus) versus genuinely-within-policy (corrupting a legitimately-variable value the agent acts on — the residual that survives, the same class ADI rides past Progent at 22.2%). So a within-capability attack is defeated where an allowlist constrains the corrupted argument, but not where the corrupted value legitimately varies. The white-box question stands.)
  • SourceProgent's policy is LLM-authored — the one model-based component. Does the "gate must not be a model" principle fully hold when the policy is still written by a model that can be talked into widening the allowlist? (The adaptive attack targeted exactly this and failed, but possibly due to the confound.)
  • SourceProvenance-aware retrofit: can a monitor that sees only tool I/O track transitive provenance to enforce the Biba invariant directly (rather than approximating it with argument patterns), without instrumenting the model's hidden reasoning? The paper flags this as the design problem the systematization implies, unanswered. (A second partial construction, for the single-run slice: APPA (arXiv 2607.24625, empirical) answers "don't infer provenance, declare it" — each tool contract states its own label delta, emits, and requires, and the engine folds the declared contribution at a pre-dispatch hook, so no hidden reasoning is instrumented and baseline enforcement runs in an ordinary protocol gateway. Two costs make it partial. The retrofit is split: label enforcement works at the MCP/gateway layer, but the branching that makes it affordable "relies on runtime confinement" — an application harness or proxy able to isolate context trajectories. And the guarantee inherits the declaration's completeness: their own eval lost a scenario to a store-writing tool declared with no sink requirement. Declared provenance moves the unsolved part from inference to authoring, which is a better place for it but not a smaller problem.) (A concrete construction also exists for the cross-session memory slice: TMA-NM (Louck, arXiv 2606.24322) enforces the Biba invariant directly — write-time origin binding + non-malleable propagation, with untrust propagated at the tool-call boundary — and machine-checks it in TLA⁺. The caveat sharpens rather than closes the question: it is not "sees only tool I/O" — it needs an authenticated origin-labeling oracle (mTLS / audience-bound OAuth / signed responses) at the trust boundary, and full value-level taint through nested structured payloads is still future work.)
  • SourceDoes the ~6× reduction and the "held under adaptive attack" result survive on a strong agent with a fatter natural attack surface (the 7B's low absolute numbers and workspace's 0% are artifacts of a weak agent), and with a stronger policy model than the local 7B? (Partly answered by AutoDojo: Progent and DRIFT held under a cheap black-box adaptive attack across five models including capable ones (GPT-4o-mini, Gemini-2.5-Flash), not just a weak 7B — but against a black-box attacker; the white-box question below stands.)
  • SourceThe utility cost (~45%→~26%) and ~15× LLM-call overhead are large. Is deterministic out-of-band enforcement economically deployable at production scale, or does the cost cap it to high-stakes action surfaces? Partially answered: NetInjectBench (arXiv 2607.10490, empirical) separates the two costs. Its deterministic gate adds zero LLM calls and raises useful-action rate (16.67% → 99.17% on attacks, 100.00% on approved changes) by substituting a safe fallback instead of terminating — so neither cost is intrinsic to deterministic enforcement. What Progent pays for is its LLM-authored policy; NetInjectBench avoids that by reading an existing change-management record. The question narrows accordingly: not "is enforcement affordable" but "where does the out-of-band policy come from, and what does that cost" — free where a system of record already exists, unmeasured elsewhere. Not settled: six mock tools, one dominant governed write, three 7–8B models.
  • SourceA structural guarantee moves the adaptive attacker's target off the model and onto the policy artifacts: APPA's two residual breaches are both contract-coverage failures, not enforcement bypasses. Is contract-completeness auditing — does every store-writing tool declare a sink requirement, does every declared delta match what the tool actually returns — tractable at production tool-surface scale, and does an attacker who can read a deployment's tool registry find such a gap reliably? No source in the corpus attempts this, and it is a different exercise from prompt red-teaming.
• Self-Propagating Prompt Injection (AI Worms)3 open
  • SourceDoes propagation actually sustain outside a lab? The disclosure demonstrates two hops (Q1 → Q2) inside one mock company. A worm needs an effective reproduction number above 1 under real conditions — real review habits, real document-reuse rates, real retrieval behaviour over a populated OneDrive. Nobody has measured the per-hop survival rate, so "worm" is currently a claim about mechanism, not about spread. Answerable only by enterprise telemetry or a controlled multi-user study.
  • SourceIs human review of AI-edited documents a viable control for anything subtler than halved numbers? The source's incidental finding is that the author had to instruct the payload to announce its own edits because attentive reviewers missed them — yet two of the three published customer mitigations are exactly that review. What is the detection rate for reviewers checking an AI-edited document they did not write, as a function of edit subtlety?
  • SourceWould visual-parity ingestion close the concealment half? The payload survives because Copilot strips formatting before the model reads the text, so what the model sees is a strict superset of what the user sees. If the model were given only what renders visibly — or the invisible residue were surfaced to the user — the payload would have to be legible to its victim. That does not touch the injection itself (a visible instruction still injects) and would trade against legitimate hidden content, but it is a deterministic, non-LLM control on the concealment channel that nothing in the corpus has tested. Related in shape to the "neutralize the bytes" answer on Agent Data Injection (ADI)'s unstructured-format question, applied at ingestion rather than at render.
• Task-Specification Effects in Prompt Injection (AutoDojo)3 open
  • SourceAutoDojo is the weakest realistic adaptive attacker (black-box, six iterations, binary signal). The authors note every axis — richer feedback (traces, token probs), non-semantic surface tricks, or a payload reshaped to resemble the user's plausible intent — is strictly stronger, so the reported ASR is a lower bound. How far do the system-level defenses hold once the payload is reshaped to look like a task-relevant action (the natural route to evading action constraints)?
  • SourceCan a gradient-optimized (white-box) injection be seeded into the loop and adapted further by the LLM search — combining white-box strength with black-box adaptation? The authors flag this as curious and untested.
  • SourceThe task-specification axis is measured on 6 action-open tasks in 3 suites. Does the action-open ≫ specified ordering (and the system-level inversion) hold at scale and on stronger agents, and is "fraction of tasks that are action-open" a usable per-deployment risk metric?
  • ResolvedIf action-open tasks are the injectable ones and also the everyday default for non-expert users, is the practical prescription to forbid action-open delegation (force the user to name the action), pushing the security burden back onto task specification — the same discipline unknown-elicitation asks for on quality grounds? Answered: Bind, Don't Forbid; Prevent, Don't Detect: The Action-Open and Poisoned-Memory Residuals — no. Forbidding is user-side friction aimed at the least-equipped party and spends the delegation value agents exist for; it is also unnecessary, because this page's own inversion shows under-specification hands action-binding defenses their best case (no named action → conservative trajectory → injected writes blocked regardless of phrasing) — the dangerous configuration is action-open plus filters-only, not action-open plus user. The ordered prescription: bind by default; when binding starves a genuinely open task, the system elicits specification (clarification-before-commit — the same move unknown-elicitation prescribes, so security and quality co-fund one discipline); route the safety-critical remainder through per-action authorization (the channel measured at 100% on protected actions). The burden lands on system structure, never on the user's phrasing.
• Write-Then-Trusted3 open
  • SourceDoes the "enumerate-the-bad controls fail" reading generalize to agents specifically, or is it the ordinary result that enumeration loses to any adaptive attacker — with agents merely making adaptivity cheap? The two readings prescribe different things (agent-specific controls vs. deny-by-default everywhere), and no source in the corpus separates them.
  • SourcePillar establishes existence and cross-vendor breadth but no prevalence: how often is a write-then-trusted path actually reached in deployed use, and what fraction of real repositories carry executable workspace configuration an agent could rewrite? A disclosure cannot answer this; it needs endpoint telemetry or a repository-scale survey.
  • SourceCan agent-write provenance (Pillar's "distinguish user-created from repo-created from agent-created project state") be enforced at the OS or VCS layer rather than by a vendor product, so that host-side automation refuses to execute agent-authored config without explicit approval? Nothing in the corpus implements it; the nearest analogue is write-time origin binding for agent memory (TMA-NM), which is the same move one substrate over. (A third substrate now asks for it: Måløy's Copilot for Word disclosure proposes preserving provenance for source material and model-performed edits in document metadata, explicitly as a traceability control rather than an injection defense — "such controls would not prevent the underlying injection, but they could make traceability much easier." Same primitive, and the same absence: nothing enforces it, and on documents there is not even a VCS layer to enforce it at.)
• Zero Trust for AI Agents3 open
  • NowThe framework treats every Claude Code "Pro-tip" as a reference implementation. How much of the framework is vendor-neutral vs. tacitly assuming the Anthropic stack?
  • Source"Foundation floor raised" implies a moving baseline. How fast does the tier ladder actually shift, and who arbitrates it (NIST/NSA cadence vs. model-capability cadence)?
  • SourceThe framework is explicit that it is not legal/compliance assurance. Where does self-attested Zero Trust maturity meet auditable regulatory requirement?