{"id":"https://openalex.org/W7164579956","doi":"https://doi.org/10.48550/arxiv.2606.12797","title":"The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements","display_name":"The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements","publication_year":2026,"publication_date":"2026-06-11","ids":{"openalex":"https://openalex.org/W7164579956","doi":"https://doi.org/10.48550/arxiv.2606.12797"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.12797","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12797","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.12797","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138527789","display_name":"Md Jafrin Hossain","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hossain, Md Jafrin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137929413","display_name":"Mohammad Arif Hossain","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hossain, Mohammad Arif","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137999675","display_name":"Weiqi Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Weiqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5008864376","display_name":"Nirwan Ansari","orcid":"https://orcid.org/0000-0001-8541-3565"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ansari, Nirwan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.18559999763965607,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.18559999763965607,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.15160000324249268,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.1088000014424324,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.460999995470047},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.4120999872684479},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.40799999237060547},{"id":"https://openalex.org/keywords/containment","display_name":"Containment (computer programming)","score":0.4074999988079071},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.3781000077724457},{"id":"https://openalex.org/keywords/due-diligence","display_name":"Due diligence","score":0.365200012922287},{"id":"https://openalex.org/keywords/government","display_name":"Government (linguistics)","score":0.3431999981403351},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.3206000030040741},{"id":"https://openalex.org/keywords/rendering","display_name":"Rendering (computer graphics)","score":0.30889999866485596}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6401000022888184},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5220000147819519},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5180000066757202},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.460999995470047},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.4120999872684479},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.40799999237060547},{"id":"https://openalex.org/C2777019822","wikidata":"https://www.wikidata.org/wiki/Q390066","display_name":"Containment (computer programming)","level":2,"score":0.4074999988079071},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.3781000077724457},{"id":"https://openalex.org/C2781016034","wikidata":"https://www.wikidata.org/wiki/Q794134","display_name":"Due diligence","level":2,"score":0.365200012922287},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.35670000314712524},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.3431999981403351},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3206000030040741},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.30889999866485596},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.30640000104904175},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.3003999888896942},{"id":"https://openalex.org/C2777834853","wikidata":"https://www.wikidata.org/wiki/Q96776939","display_name":"Liability","level":2,"score":0.2858000099658966},{"id":"https://openalex.org/C2780027415","wikidata":"https://www.wikidata.org/wiki/Q524648","display_name":"Language change","level":2,"score":0.2851000130176544},{"id":"https://openalex.org/C2776515129","wikidata":"https://www.wikidata.org/wiki/Q7306218","display_name":"Redress","level":2,"score":0.2815000116825104},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.2786000072956085},{"id":"https://openalex.org/C27415008","wikidata":"https://www.wikidata.org/wiki/Q7256382","display_name":"Psychological intervention","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.2696000039577484},{"id":"https://openalex.org/C2776007630","wikidata":"https://www.wikidata.org/wiki/Q2798912","display_name":"Accountability","level":2,"score":0.2653999924659729},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.2572999894618988},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.25690001249313354},{"id":"https://openalex.org/C18131444","wikidata":"https://www.wikidata.org/wiki/Q163585","display_name":"Memory protection","level":5,"score":0.2533999979496002},{"id":"https://openalex.org/C188087704","wikidata":"https://www.wikidata.org/wiki/Q369577","display_name":"Standardization","level":2,"score":0.250900000333786}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.12797","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12797","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.12797","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12797","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7901021838188171,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Agentic":[0],"large":[1],"language":[2],"model":[3,53],"systems":[4,39],"that":[5,192],"autonomously":[6],"invoke":[7],"tools,":[8],"maintain":[9],"persistent":[10,118],"memory,":[11],"and":[12,27,64,68,125,175,207],"execute":[13],"multi-step":[14],"plans":[15],"are":[16],"increasingly":[17],"deployed":[18],"in":[19,73,92,104,216],"public-facing":[20,205],"domains,":[21],"including":[22],"government":[23,107],"services,":[24],"healthcare":[25],"triage,":[26],"financial":[28],"advising.":[29],"We":[30,99,164,190],"ask":[31],"whether":[32],"the":[33,84,95,128,142,156,193],"frameworks":[34,61],"used":[35],"to":[36,135,159,212],"build":[37],"these":[38,101],"provide":[40],"architectural-level":[41],"structural":[42],"safety":[43],"guarantees.":[44],"Applying":[45],"six":[46],"containment":[47,169],"principles":[48],"derived":[49],"from":[50],"a":[51,79,105,113,138,171,176],"compositional":[52],"of":[54,75,83,94],"agentic":[55,195],"architectures,":[56],"we":[57],"audit":[58],"three":[59,96],"dominant":[60],"(LangChain,":[62],"AutoGPT,":[63],"OpenAI":[65],"Agents":[66],"SDK)":[67],"find":[69],"no":[70],"native":[71],"compliance":[72],"any":[74,93],"them.":[76],"Memory":[77],"integrity,":[78],"defense":[80],"against":[81],"one":[82],"most":[85],"prevalent":[86],"vulnerability":[87],"classes,":[88],"is":[89],"not":[90,199],"observed":[91],"evaluated":[97],"frameworks.":[98],"validate":[100],"findings":[102],"empirically:":[103],"simulated":[106],"benefits":[108],"agent":[109],"built":[110],"on":[111],"LangChain,":[112],"single":[114],"memory-poisoning":[115],"write":[116],"induces":[117],"targeted":[119,133,150],"corruption":[120,157],"across":[121],"all":[122],"tested":[123],"seeds":[124],"backends,":[126],"increasing":[127,149],"wrongful":[129,151],"denial":[130],"rate":[131],"for":[132,204],"applicants":[134],"88.9%.":[136],"Under":[137],"complex":[139],"five-factor":[140],"policy,":[141],"same":[143],"attack":[144,182],"preserves":[145],"aggregate":[146],"accuracy":[147],"while":[148],"denials":[152],"by":[153],"3.5x,":[154],"rendering":[155],"difficult":[158],"detect":[160],"through":[161],"standard":[162],"monitoring.":[163],"then":[165],"introduce":[166],"two":[167],"lightweight":[168],"mechanisms:":[170],"memory":[172],"integrity":[173],"validator":[174],"policy":[177],"gate,":[178],"which":[179],"eliminate":[180],"both":[181],"vectors":[183],"with":[184],"sub-millisecond":[185],"overhead":[186],"(<0.2ms":[187],"per":[188],"call).":[189],"conclude":[191],"current":[194],"framework":[196],"ecosystem":[197],"may":[198],"yet":[200],"meet":[201],"secure-by-default":[202],"expectations":[203],"deployments":[206],"outline":[208],"priority":[209],"architectural":[210],"interventions":[211],"enable":[213],"trustworthy":[214],"deployment":[215],"high-stakes,":[217],"socially":[218],"impactful":[219],"applications.":[220]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-13T00:00:00"}