Token-Flow Firewall audits persistent agents at the natural-language chokepoint.

arXiv 2607.08395 observes that persistent agents (long-lived memory, reusable skills, tool-mediated state) have a far larger semantic attack surface than chat assistants, because unsafe content propagates through stored state instead of dying with the session. Nearly all security-critical interactions pass through natural-language token flows: memory updates, tool arguments, retrieved content. Auditing at that boundary at runtime is cheaper than sanitizing every component. This maps directly onto any pipeline that persists findings or skills across runs, which is most self-improving harnesses.