Failure modes · Policy · Evidence
Prompts are suggestions.
We study what makes rules hold.
Sondera examines how agents fail, how human intent becomes enforceable policy, and how runtime evidence proves what an agent actually did.
Research presented at
Conferences this research has been presented at
Research index · Papers · Talks · Demos · Open source
Research that turns intent into
a decision you can inspect.
-
ICML 2026 · FLoC 2026 Paper
Autoformalization of Agent Instructions into Policy-as-Code
ICML AIWILD Workshop and FLoC LLM-Solve
Adam Mondl · Matthew Maisel · John H. Brock
A pipeline for translating natural-language agent instructions, tool schemas, and policy documents into checked policy before an agent acts.
Read the paper on arXiv -
Unprompted Talk
Hooking Coding Agents with the Cedar Policy Language
Matthew Maisel
A technical talk on bringing policy into the coding-agent loop so agent actions can be constrained before they complete.
Watch the talk -
Black Hat Arsenal Talk
GolemHalt: A Deterministic Reference Monitor for AI Coding Agents
Adam Mondl · Matthew Maisel · John H. Brock
A deterministic reference monitor for AI coding agents, built in Rust with Cedar and YARA-X. Presented live in August 2026.
View the Arsenal listing -
Graph the Planet 2026 Demo
Live Demo: Runtime Policy Enforcement for Coding Agents
Josh Devon · Matthew Maisel
A live demonstration for the graph and AI security community at Graph the Planet 2026, hosted at Bloomberg R&D during RSAC week.
Watch the demo -
GitHub Open source
sondera-coding-agent-hooks
MIT license
Runtime policy hooks for coding agents, a Cedar policy engine integration, and an autoformalization skill that turns written rules into checked policy. Released alongside the GolemHalt Arsenal talk.
View on GitHub
Secure Trajectories blog
Selected writing from the research team.
-
Safe Was a Policy Decision All Along
OpenAI's models breached a company to cheat on a test. The scary part isn't that they broke a rule. It's that they didn't.
Read: Safe Was a Policy Decision All Along -
LLMs-as-Judges Miss Bad Behavior
Context rot affects the watchers too. As an agent's run grows, the LLM monitoring it misses buried dangerous actions up to 30 times more often.
Read: LLMs-as-Judges Miss Bad Behavior -
How We Hijacked a Claude Skill with an Invisible Sentence
A logic-based attack bypasses both the human eyeball test and the platform's own prompt guardrails, revealing a critical flaw in today's agent security model.
Read: How We Hijacked a Claude Skill with an Invisible Sentence
Research agenda
From natural language to
a checked decision.
Semantic integrity: an agent's actions carry out the intent behind them, at every step.
Semantic integrity four properties
-
Source authorization
Who gave this instruction, and were they allowed to?
-
Task alignment
Is this action still serving the task the user gave?
-
Data isolation
Is data crossing a boundary it shouldn't?
-
Action alignment
Is the action about to run the action that was approved?
Contextual agent security · Siu et al., ICML 2026
The open problems
Four research problems in making semantic integrity hold.
-
Autoformalization
Written rules become checked policy.
Instructions written naturally, tool definitions, and requirements are transformed into policy that can be checked before an action runs.
-
Runtime enforcement
Actions meet boundaries.
The security decision moves to the moment an agent asks to read, write, call a tool, or move data across a boundary. What policy can express at that moment is the open question.
-
Trajectory evidence
Behavior becomes inspectable.
Agent behavior treated as a trajectory: context, tool calls, policy attributes, verdicts, and the rule path behind them.
-
Scalable oversight
Humans should not review every action.
Policy, monitors, and evidence that help security teams supervise agent fleets without turning autonomy back into manual approval.