{"id":"https://openalex.org/W7225327672","doi":"https://doi.org/10.6084/m9.figshare.34932510","title":"AgentECC: Repairing Hijacked Agent Actions Wherever the Environment Keeps a Witness","display_name":"AgentECC: Repairing Hijacked Agent Actions Wherever the Environment Keeps a Witness","publication_year":2026,"publication_date":"2026-11-05","ids":{"openalex":"https://openalex.org/W7225327672","doi":"https://doi.org/10.6084/m9.figshare.34932510"},"language":"en","primary_location":{"id":"doi:10.6084/m9.figshare.34932510","doi":"https://doi.org/10.6084/m9.figshare.34932510","is_oa":true,"landing_page_url":"https://doi.org/10.6084/m9.figshare.34932510","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.6084/m9.figshare.34932510","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5160917871","display_name":"Jicheng Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jicheng Wang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136495220","display_name":"Zili Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zili Wang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160836148","display_name":"Chu Lin","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chu Lin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160786683","display_name":"Xianzhong Ding","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xianzhong Ding","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160935218","display_name":"Jiachen Liu","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiachen Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100461963","display_name":"Yifeng He","orcid":"https://orcid.org/0000-0002-1700-3166","observed_orcids":["https://orcid.org/0000-0002-1700-3166"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yifeng He","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5160963405","display_name":"Hao Chen","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hao Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6128000020980835,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6128000020980835,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.23839999735355377,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.06960000097751617,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/tool-using-agents","display_name":"tool-using agents","score":0.8669999837875366},{"id":"https://openalex.org/keywords/false-data-injection-attacks","display_name":"false data injection attacks","score":0.7519999742507935},{"id":"https://openalex.org/keywords/data-recovery","display_name":"data recovery","score":0.5759999752044678},{"id":"https://openalex.org/keywords/corrupted-data","display_name":"corrupted data","score":0.5180000066757202},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.44699999690055847},{"id":"https://openalex.org/keywords/agentdojo","display_name":"AgentDojo","score":0.5460000038146973},{"id":"https://openalex.org/keywords/gpt-4o","display_name":"GPT-4o","score":0.5870000123977661},{"id":"https://openalex.org/keywords/qwen3-5","display_name":"Qwen3.5","score":0.6389999985694885},{"id":"https://openalex.org/keywords/adaptive-search","display_name":"adaptive search","score":0.34599998593330383},{"id":"https://openalex.org/keywords/environmental-coverage","display_name":"environmental coverage","score":0.33799999952316284}],"concepts":[{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.8604000210762024},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6902999877929688},{"id":"https://openalex.org/C145097563","wikidata":"https://www.wikidata.org/wiki/Q1148747","display_name":"Payment","level":2,"score":0.667900025844574},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6273999810218811},{"id":"https://openalex.org/C2776900844","wikidata":"https://www.wikidata.org/wiki/Q8028383","display_name":"Witness","level":2,"score":0.6086000204086304},{"id":"https://openalex.org/C52146309","wikidata":"https://www.wikidata.org/wiki/Q7431116","display_name":"Schema (genetic algorithms)","level":2,"score":0.40939998626708984},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4088999927043915},{"id":"https://openalex.org/C2776291640","wikidata":"https://www.wikidata.org/wiki/Q2912517","display_name":"Value (mathematics)","level":2,"score":0.3944999873638153},{"id":"https://openalex.org/C199776023","wikidata":"https://www.wikidata.org/wiki/Q202875","display_name":"Negotiation","level":2,"score":0.34619998931884766},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.2930000126361847},{"id":"https://openalex.org/C98184364","wikidata":"https://www.wikidata.org/wiki/Q1780131","display_name":"Argument (complex analysis)","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2874000072479248},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.27379998564720154},{"id":"https://openalex.org/C2777852691","wikidata":"https://www.wikidata.org/wiki/Q13430821","display_name":"Crowds","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C20574231","wikidata":"https://www.wikidata.org/wiki/Q844605","display_name":"Backward compatibility","level":2,"score":0.25189998745918274}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.6084/m9.figshare.34932510","doi":"https://doi.org/10.6084/m9.figshare.34932510","is_oa":true,"landing_page_url":"https://doi.org/10.6084/m9.figshare.34932510","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.6084/m9.figshare.34932510.v1","doi":"https://doi.org/10.6084/m9.figshare.34932510.v1","is_oa":true,"landing_page_url":"https://doi.org/10.6084/m9.figshare.34932510.v1","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.6084/m9.figshare.34932510","doi":"https://doi.org/10.6084/m9.figshare.34932510","is_oa":true,"landing_page_url":"https://doi.org/10.6084/m9.figshare.34932510","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, justice, and strong institutions","score":0.4399999976158142,"id":"https://metadata.un.org/sdg/16"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7220739407","https://openalex.org/W7225244516","https://openalex.org/W7165142340","https://openalex.org/W7162791588","https://openalex.org/W7172000952","https://openalex.org/W7160539043","https://openalex.org/W7171729184","https://openalex.org/W7223214740","https://openalex.org/W7225091562","https://openalex.org/W7223404996"],"abstract_inverted_index":{"Tool-using":[0],"agents":[1,64],"act":[2],"on":[3,218,223,229,264],"data":[4],"they":[5],"do":[6,271],"not":[7,43,66,275],"control.":[8],"A":[9,48],"line":[10],"planted":[11],"in":[12,235],"an":[13,84,119,137],"email":[14],"or":[15,162],"a":[16,20,124,145,159,168,179,279],"file":[17],"can":[18,34,113,281],"redirect":[19],"payment":[21,41],"while":[22],"the":[23,26,36,40,54,73,89,91,95,115,202,249,277,288],"rest":[24],"of":[25,62,210,262],"task":[27],"runs":[28,212],"as":[29,76],"asked.":[30],"An":[31],"execution":[32],"guard":[33,96,126],"refuse":[35],"call,":[37],"but":[38],"stopping":[39],"does":[42],"recover":[44],"its":[45,192,246],"intended":[46],"payee.":[47],"person":[49],"may":[50],"have":[51],"to":[52,68,252,270],"finish":[53],"task,":[55],"and":[56,143,152,190,225,266,290],"that":[57,111,244],"handoff":[58],"cost":[59],"is":[60,123,133,188],"much":[61],"why":[63],"are":[65],"left":[67],"run":[69],"unattended.":[70],"We":[71,183],"treat":[72],"injected":[74],"value":[75,90,117],"corrupted":[77],"data,":[78],"with":[79,127,175,201,231,304],"two":[80],"recovery":[81],"paths.":[82],"When":[83,102],"independent,":[85],"protected":[86],"record":[87,104],"determines":[88,105],"authorized":[92,120,291],"action":[93],"needs,":[94],"restores":[97],"it":[98],"without":[99,178],"human":[100],"involvement.":[101],"no":[103,232,242],"it,":[106],"one":[107],"scoped":[108],"question":[109,205],"about":[110,254],"field":[112],"obtain":[114],"missing":[116],"from":[118],"source.":[121],"AgentECC":[122,207],"runtime":[125,167],"both":[128],"responses,":[129],"refusing":[130],"when":[131,185],"neither":[132],"available.":[134],"Before":[135],"deployment,":[136],"agent":[138],"reads":[139],"each":[140,164,172,186],"tool's":[141],"schema":[142],"writes":[144],"contract":[146],"naming":[147],"which":[148,153],"arguments":[149],"carry":[150],"consequences":[151],"trusted":[154],"sources":[155],"hold":[156],"their":[157,294],"copies;":[158],"linter":[160],"admits":[161],"rejects":[163],"entry.":[165],"At":[166],"deterministic":[169],"check":[170],"compares":[171],"guarded":[173],"argument":[174],"those":[176],"sources,":[177],"model":[180],"judging":[181],"safety.":[182],"state":[184],"response":[187],"sound":[189],"measure":[191],"environmental":[193],"coverage":[194],"before":[195],"attacks.":[196],"On":[197],"AgentDojo's":[198],"rent":[199],"tasks,":[200],"same":[203,250],"amount-scoped":[204],"channel,":[206],"keeps":[208,260],"13":[209],"20":[211,263],"under":[213],"injection":[214,243],"against":[215,221,227],"refusal's":[216],"5":[217,261],"GPT-4o,":[219,265],"14":[220],"7":[222],"GPT-5.5,":[224],"10":[226],"1":[228],"Qwen3.5-9B,":[230],"successful":[233],"attacks":[234],"these":[236],"cohorts.":[237],"Evaluated":[238],"adaptive":[239],"searches":[240],"find":[241],"passes":[245],"check.":[247],"Given":[248],"power":[251],"ask":[253],"every":[255],"contested":[256],"field,":[257],"refusal":[258],"still":[259],"asks":[267],"more":[268,283],"questions":[269],"it.":[272],"Refusal":[273],"need":[274],"be":[276],"endpoint:":[278],"deployment":[280],"make":[282],"actions":[284],"recoverable":[285],"by":[286],"engineering":[287],"records":[289],"answer":[292],"channels":[293],"fields":[295],"need.Preprint,":[296],"version":[297],"v1":[298],"(manuscript":[299],"dated":[300],"2026-10-05).":[301],"Landing":[302],"page":[303],"full-text":[305],"HTML:":[306],"https://jeremyjc67.github.io/papers/agentecc/":[307]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-11-06T00:00:00"}