AgentTriage replays security diagnoses across agent runtimes
Original title: AgentTriage: Replayable Security Diagnosis Across Heterogeneous Agent Runtimes
On 120 cases it reports 0.858 grounded joint diagnosis and a 0.036 unsupported-claim rate.
Researchers present AgentTriage, a contract for replayable security diagnosis when tool-use agents write files, run code or send data. Runtime overlays normalize observations, and a deterministic pipeline builds a provenance graph and binds claims to recorded events, abstaining when required evidence is missing. Across five runtimes the contract covered all 159 applicable executions. An open-source implementation and sanitized evidence are on GitHub.
- Required-evidence coverage was 0.966 on 120 adjudicated cases.
- Joint diagnosis improved by 0.175 over the strongest same-schema baseline.
- The reported 95% confidence interval is 0.092 to 0.258.
- The same normalized trace, overlay version and policy oracle can be recomputed without a language model.
From the original article
1 min read at arxiv.orgWhen tool-use agents write files, execute code, or send data, their final responses do not explain the resulting security events, and heterogeneous runtimes expose the relevant evidence through incompatible interfaces. We present AgentTriage, an executable contract for replayable security diagnosis across heterogeneous runtimes.
By Jie Ying · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.