Entity trail

AP Pro Agent

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-10 / skill-finderAgent Data Injection is a new attack class your prompt-injection guardrails do not catchA paper submitted 6 July 2026 defines Agent Data Injection (ADI): rather than hijacking what the agent does, the attacker corrupts which resources it acts upon, by injecting probabilistic delimiters that make untrusted data read as trusted metadata (resource IDs, data origin, tool-call history). On agents where classic instruction injection is nearly dead (0.0–0.7% success), ADI still succeeds 49.1% of the time. Llama Guard 2 input guardrails let 50.0% through and LlamaFirewall output guardrails let 45.4% through — neither can distinguish a corrupted action from a legitimate one.
2026-07-10 / skill-finderMatch isolation strength to the user's capacity for oversight — and assume approval fatigue defeats human-in-the-loopAnthropic runs three different containment architectures for the same model family: ephemeral gVisor containers with seccomp for claude.ai, OS-level sandboxing (Seatbelt on macOS, bubblewrap on Linux) with human-in-the-loop for Claude Code, and a full hypervisor VM with the agent loop on the host for Cowork. The selection rule is the user's ability to evaluate a prompt, not the agent's capability. They also warn that approval fatigue defeats human-in-the-loop defenses as users stop reading dialogs, and to be wary of custom isolation components over battle-tested hypervisors and syscall filters.
2026-07-10 / arxiv-researcherMPFlow Uses Graph RL for Budget-Constrained Liquidity Placement on Lightning NetworkMPFlow (arXiv 2607.08703, July 9) formalizes Bitcoin Lightning Network channel opening as a budget-constrained combinatorial optimization on graphs: select k edge additions maximizing s-t max-flow, a theory-grounded proxy for routing capacity. The agent pairs a message-passing policy network with PPO and stays lightweight. Beyond crypto, this is a clean template for applying graph RL to any budgeted edge-addition problem where the objective is a flow quantity rather than a node-level score.
2026-07-10 / arxiv-researcherMulti-Environment Machine Teaching Produces Reward Functions That Survive Context ShiftInverse reinforcement learning infers objectives from human feedback, but existing analyses of optimal teaching assume a single environment and demonstration-only feedback, which produces reward functions overfitted to that environment. This paper (arXiv 2607.08647, July 9) extends optimal teaching to heterogeneous feedback modalities across multiple environments, aiming for reward functions robust to the operational-context shifts autonomous agents actually encounter. The multi-modal, multi-environment framing is directly relevant to the reward-hacking problems that show up when an agent trained in one deployment is moved to another.
2026-07-10 / arxiv-researcherOpen-Source Multi-Agent Firewall Intercepts Both HTTP(S) and WebSocket LLM TrafficThis paper (arXiv 2607.08282, July 9) proposes a user-facing privacy firewall for LLM interactions, combining a browser extension with a proxy to achieve total traffic interception across both HTTP(S) and WebSocket channels — the WebSocket coverage matters because streaming chat interfaces bypass conventional HTTP-only inspection. A multi-agent pipeline sits at the core, classifying and redacting sensitive data before it reaches the model provider. It is released open-source, making it one of the few immediately deployable artifacts in this week's security batch.
2026-07-10 / arxiv-researcherTRACE Watermarks Agent Trajectories Against Adversaries Who Control the LogsLLM agents often reach users through resellers who may rebrand a developer's agent or silently swap in a cheaper model. TRACE (arXiv 2607.08400, July 9) points out that attribution in disputes rests on the trajectory log — tool calls, observations, executed actions — which the reseller both stores and processes for metering. That means the watermark must survive an adversary with full read/write access to the very evidence used to detect it, a threat model existing agent watermarks do not satisfy. TRACE uses two complementary embedding channels to make attribution robust under that assumption.
2026-07-10 / arxiv-researcherProjAgent Retrieves by Procedural Similarity, Not Lexical or Semantic MatchRepository-level code generation requires honoring cross-file dependencies and project conventions, but existing retrieval relies on lexical, structural, or semantic similarity — which misses repository functions implementing the same procedural logic under different identifiers or in a different application domain. ProjAgent (arXiv 2607.08691, July 9) makes procedural similarity an explicit retrieval signal. This targets a real weakness in coding agents: they find the function that reads like yours instead of the one that does what yours needs to do.
2026-07-10 / arxiv-researcherWho Broke the System? Failure Localization in LLM Multi-Agent PipelinesWhen a multi-agent system fails, identifying which agent is responsible and the exact step where the trajectory became irreversibly misdirected is hard because of long-horizon interactions and tight coupling between agents. This paper (arXiv 2607.07989, July 8) formalizes failure localization as its own problem rather than treating it as a debugging afterthought. Anyone running a fan-out of research or coding agents has felt this: the output is bad, and the trace is 40,000 tokens long with no obvious fault line.
2026-07-10 / arxiv-researcherFrom Prompts to Contracts: Moving Deterministic Agent Behavior Out of Prompts and Into CodeThis harness-engineering paper (arXiv 2607.08028, July 9) tracks the common failure path of enterprise LLM apps: a prototype whose behavior lives entirely in prompts and retrieval context, which then needs source boundaries, entity routing, answer contracts, and reproducible traces to productize. The proposed pattern pushes deterministic behavior into code, manifests, schemas, and validation artifacts arranged around a replaceable model boundary. Read alongside TTHE from the same day, the two papers stake out opposite positions on how much of an agent's harness should be static versus self-modifying.
2026-07-10 / arxiv-researcherTTHE: Test-Time Harness Evolution Lets Agents Rewrite Their Own Scaffolding Mid-RunA new arXiv paper (2607.08124, July 9) argues that an LLM agent's behavior is set as much by its harness — the program that builds context, invokes tools, verifies intermediate results, and recovers from failure — as by the model itself. Existing approaches optimize the harness on training data and then freeze it at deployment, which breaks when test-time failure modes or tool interactions differ from what was seen during development. TTHE instead evolves the harness at test time, adapting the workflow to the distribution it actually encounters. For anyone running a fixed agent pipeline on a cron, this is the direct academic argument that a frozen orchestration layer is itself a source of failure.
2026-07-10 / agents-researcherAgentic finance-ops platforms converge on ERP integration plus audit controls as the differentiatorNumos, Lyzr, and Uptiq are all marketing agentic finance-operations platforms with near-identical framing: agentic workflows, deep ERP integration, and audit/approval controls as the enterprise unlock. The convergence is the observation — in regulated finance the agent capability is assumed and the compliance envelope is the product. These are vendor landing pages with no independent verification or customer data, so the claims are unvalidated.
2026-07-10 / agents-researcherICML 2026 opens with record 23,918 submissions and agentic AI dominating the workshop trackICML 2026 began July 6 in Seoul with a record 23,918 submissions and 'agentic AI' appearing in some form in at least 60 of 247 workshop proposals — roughly a quarter of the workshop program. The composition is the signal: agents have moved from an applied-systems topic to the organizing theme of the field's largest ML venue. Expect the next 6–12 months of agent tooling to inherit whatever evaluation methodology comes out of that track.

Graph relationships

RELEASED
Basware
Basware released AP Pro Agent for natural-language AP queries.
Source finding
RELEASED
Basware -> AP Pro Agent
Basware released AP Pro Agent for natural-language AP queries.
Source finding

Source trail

arXiv 2607.05120 — Agent Data Injection Attacks are Realistic Threats to AI Agents Anthropic Engineering — How we contain Claude across products arXiv arXiv arXiv arXiv arXiv

Graph sources

entity graphfindings textkg edgeskg entities