Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
It maps attention like an image to find which tokens hijacked a tool call, then checks the source's authority.
Why now: Attnlocate posted to arXiv in August 2026.
Attnlocate turns attention weights into a 1-D image and detects the token span that hijacked an agent's tool call. An agent that can't tell whose instructions it's following will carry out an injected command as if the user asked for it.
Across ten agent setups spanning five model families, the method reached a 93.4% detection rate at a 6.7% false-positive rate. Locating the exact span, it also averaged a 0.743 mean IoU and a 0.956 AUROC.
The system pools attention across every head and layer into a token-level feature space. It then runs a 1-D U-Net with an anchor-free detection head, the architecture family used for finding objects in images. Instead of boxing a cat, it boxes the tokens that steered a tool call, then checks who supplied them before the agent acts.
The method also transfers to unseen models and new policy configurations without retraining, so a team wouldn't retrain it per deployment.
What the paper doesn't cover is deployment cost. Running attention-based localization on every tool call means instrumenting the agent's inference path, and nothing in the results says what that adds to latency. Static filters are cheap and already deployed everywhere. This only wins if it can run on every step without slowing an agent down.
Each link below shares sources, entities, or timing with this story.
Shared entity: AUROC / Same source domain / Shared topic / Earlier coverage / Tension
Both cover AUROC; reported by the same outlet (arxiv.org); overlapping topics (agent, auroc, beat).
Shared entity: AUROC / Same source domain / Shared topic / Earlier coverage
Both cover AUROC; reported by the same outlet (arxiv.org); overlapping topics (agent, auroc, model).
Both cover AUROC; reported by the same outlet (arxiv.org); overlapping topics (auroc, model).
Both cover AUROC; reported by the same outlet (arxiv.org); overlapping topics (agent, auroc).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (argument, attention, beat, head); pushes against this story (but).
Reported by the same outlet (arxiv.org); overlapping topics (agent, average, beat, model); pushes against this story (against).
Shared entity: AUROC / Same source domain / Earlier coverage / Tension
Both cover AUROC; reported by the same outlet (arxiv.org); earlier AUROC coverage from 2026-08-14.
Shared entity: FPR / Same source domain / Earlier coverage / Tension
Both cover FPR; reported by the same outlet (arxiv.org); earlier FPR coverage from 2026-07-26.