157 open-source agent projects audited, and guards sit on one route to an action but not the equivalent one.

arXiv 2609.17698 read documentation, source, config and tests across 157 LLM-agent projects with 100+ stars. Coverage fragments in a specific, checkable way: a guard on the direct tool call and nothing on the shell that reaches the same effect, tests that rarely exercise boundary or multi-step tool-use failures, risks named in a project's own docs that never become end-to-end checks. The audit that follows from this is mechanical. Enumerate every route to a consequential action (direct tool call, code execution, shell, an MCP server exposing the same capability) and confirm the guard is on all of them.