SEAD: State-Based Security Framework for Tool-Using Agents Intercepts 92.7% of Harmful Paths, Slashing Attack Success from 48% to 4%

Core Background & Industry Pain Points As language-model coding agents and DevOps assistants gain write privileges across shell terminals, container runtimes, and databases, security defenses face an unprecedented paradigm shift. Traditional guardrails focus on keyword filtering and static prompt analysis, which fail against state-based multi-step attacks: 1. The Delayed Lethality of State Mutations: Attackers rarely issue overt malicious commands like 'drop database.' Instead, they guide the agent through innocuous-looking precursor steps—altering file permissions, repointing symlinks, or injecting path overrides—such that a subsequent standard command (e.g., 'clear temporary cache') triggers catastrophic data destruction; 2. Blindness to Underlying System State: Conventional guardrails evaluate conversational transcripts in isolation, remaining completely blind to the actual filesystem, privilege, or database state mutated by prior tool calls. ### Architectural Highlights & Underlying Mechanics Researchers introduce SEAD, the first framework formalizing agent attack and defense as partially observed state control: 1. State-Centric Threat Formulation: Demonstrates that the gap between a seemingly benign action request and its catastrophic execution outcome is governed by hidden state mutations accumulated across historical steps; 2. DART Adversarial Trajectory Generation: Systematically decomposes malicious goals into locally plausible, policy-compliant instructions. Using runtime execution feedback from actual sandbox environments, DART optimizes attack trajectories that bypass static inspection; 3. SAGE State-Aware Guardrail Defender: Before any state-altering action executes, SAGE dynamically dispatches side-effect-free, read-only inspection probes (e.g., checking file descriptors, permissions, and symlink targets). It evaluates the real environment state against safety invariants before granting execution permission. ### Benchmark & Experimental Validation Evaluated across reproducible execution environments using four state-of-the-art foundation models: - DART Penetration Superiority: DART increases semantic attack success rates by 18.8 to 35.9 percentage points over state-of-the-art baselines, proving that transcript-level guardrails are inadequate; - SAGE Slashes Executable Attack Success: In live interactive attack-defense evaluations, SAGE compresses executable attack success rates from 48.0% down to 4.0%; - Minimal Disruption to Legitimate Tasks: SAGE intercepts 92.73% of harmful execution paths while preserving 95.79% of benign workflows, avoiding developer friction from false positives. ### Engineering Takeaways & Practical Guide - Code & Dataset Access: The full codebase, environments, and test harness are available on GitHub at EverywhereSafety/SEAD; - Operational Guidance for Agent Deployments: Never rely solely on LLM self-reflection before running potentially destructive tools. Integrate pre-execution read-only state validation hooks into agent execution harnesses; - Protocol Integration: SAGE's state probe pattern is readily implementable as Model Context Protocol (MCP) middleware to guard enterprise agents across diverse host environments.