Monthly AI Security Research Review

This monthly review is a dated research ledger, not a leaderboard. It records security-relevant evidence published during the stated window, explains what each result can and cannot establish, and turns the findings into bounded engineering actions. A paper is a reason to test a control, not proof that a product is safe or unsafe.

SEPTEMBER 2026 — MONTH-TO-DATE

Edition: September 2026 — month-to-date
Evidence cutoff: 2026-09-14
Primary source window: 2026-09-01 to 2026-09-14
Next scheduled review: end of September 2026 / next monthly edition
Quarterly consolidation: deferred until the quarter boundary

The cutoff matters. Preprints can change, benchmarks can be corrected, and a result produced with synthetic traces or a particular model may not transfer to a deployed agent. Confidence below refers to how directly the source supports the stated finding, not to a universal probability that a control will work.

SEPTEMBER 2026 AI SECURITY RESEARCH LEDGER

Source / date	Question and method	Finding to track	Limitation	Engineering action	Confidence
EAL: Memory Laundering in LLM Agents, arXiv, 2026-09-01	EAL-Bench tests five writers and two executors in scenarios where false claims can enter durable agent memory	False authority was written at rates up to 50.2%; executors acted on false authority in 98.6% of trials. Source-backed permissions and bounded event sourcing reduced laundering	Preprint and benchmark-specific; synthetic traces do not represent every memory system	Treat memory as untrusted input; bind sensitive facts to provenance, scope, and an authorization record before reuse. Re-test with AI Red Teaming	High for the reported benchmark; transfer is medium
AgentDrift: Detecting Multi-Turn Tool-Use Drift, arXiv, 2026-09-07	12,536 synthetic tool trajectories and 71,024 labeled steps classify scope, authority, and instruction drift	Hard negatives fooled the judge; a surface logistic model reached F1 0.647. Partial hijacks occurred in 8.2% of traces and delayed executions in 23.1%	One open model, synthetic trajectories, and a particular labeling design	Log tool intent and authority at every step; add delayed-action and recovery-path tests, not just first-call checks	Medium
VEX-Bench: Verifiable Exploitability for Dependency Changes, arXiv/EMNLP 2026, 2026-09-07	75 real supply-chain cases across Python, Java, and Go evaluated nine models with three harnesses	GPT-5.5 and Claude Opus 4.6 were near 80% binary F1, but only GPT-5.5 exceeded 70% macro-F1 on fine-grained labels	Benchmark cases and harness availability constrain generalization; performance is not permission to merge a dependency	Require manifest diff review, provenance checks, and human approval for risky dependency edits; connect to the AI Security Controls Matrix	Medium-high
PrivEscalate: Evaluating LLM Agents in Privilege Escalation Scenarios, arXiv, 2026-09-08	531 Dockerized scenarios in 14 categories plus 329 perturbation variants test six models and three agent architectures	Capability varied by scenario and architecture; small perturbations changed outcomes, showing that a single pass/fail run is brittle	Preprint, containerized scenarios, and limited model set; results are not a product certification	Run adversarial variants with least privilege, sandboxing, and explicit stop conditions. Keep the model outside the enforcement boundary	Medium
BlueSTAR: Threat Detection for Agentic IT/OT Operations, arXiv, 2026-09-10	Tiered telemetry-to-IOC detection architecture evaluated in two live IT/OT ranges across seven attack chains	The paper reports a resilience metric that joins telemetry, detection, and response across chained actions	Abstract-level public detail is limited; range behavior may not match SaaS deployments	Define evidence before an incident: actor, action, resource, policy decision, and response latency. Use Observability practices without copying an unverified score	Low-medium

This ledger deliberately records method and limitation beside the headline. A high score with a narrow protocol is useful evidence for that protocol; it is not a general claim about every model, tool gateway, or customer workload.

EVIDENCE-TO-ACTION FILTER

Use five questions before turning a paper into a roadmap item:

1. What is the unit? Identify model revision, agent harness, tools, data, permissions, and runtime. A result from a read-only executor does not establish behavior when write tools are enabled.
2. What counts as success? Record the denominator, labels, judge, repetitions, and whether an event was immediate or delayed. A judge-model score can hide disagreement or hard negatives.
3. What transfers? Map the source conditions to identity, tenant, network, credentials, and approval boundaries in your product. If a condition differs, label the result as a hypothesis and reproduce it locally.
4. Which control changes the outcome? Prefer a control with an observable enforcement point: a permission check, provenance requirement, dependency review, egress policy, or queue budget. Prompts can guide behavior but cannot replace these controls.
5. What evidence will close the loop? Name the test, log, alert, or review record that proves the control operated. A ticket saying “mitigated” is weaker than a denied call, a preserved audit event, and a passing regression test.

For a repeatable process, compare the publication ledger with the AI Security Controls Matrix. Use its threat-to-verification framing to assign an owner, a test, and a retest date. For model and agent benchmark literacy, see Frontier Model Evaluations, which explains why model capability, safeguards, and deployment authority must be read as separate claims.

WHAT CHANGED THIS MONTH-TO-DATE

Three themes stand out in the first half of September.

Durable context is an authority surface. EAL-Bench makes memory laundering concrete: a statement can look like a remembered fact while actually being untrusted text. The practical change is to keep provenance, source scope, and permission state attached to memory entries. A summary or embedding is not a new authorization. Sensitive memory should be rechecked against current policy at use time, and deletion should propagate to derived stores.

Multi-turn drift is often delayed. AgentDrift’s delayed-execution results reinforce a failure mode that ordinary request tests miss. An agent can begin in an allowed state and cross a boundary after retries, a new tool result, or a changed plan. Gate every consequential call, record the intended scope, and make a stop or approval decision available after intermediate steps. Do not assume a safe first tool call makes the whole run safe.

Security evidence is becoming more system-shaped. VEX-Bench and PrivEscalate evaluate a model inside a harness, while BlueSTAR emphasizes telemetry and response across a chain. Together they suggest that a model score is only one layer of assurance. Teams should evaluate the assembled system: model, prompt, tools, identity, data, network, budgets, monitors, and human approvals. Regression suites should include perturbations, not just canonical prompts.

The common implication is not “block every agent.” It is to move high-impact decisions to trusted enforcement points and preserve enough evidence to investigate a surprising result. Read-only pilots, bounded credentials, isolated execution, and explicit rollback are practical ways to learn without granting a benchmark the authority to redesign production policy.

WATCHLIST

The next edition will check for changes in five areas:

• Memory and provenance: follow-up work on source-backed permissions, event-sourced memory, and whether protections survive summarization and retrieval.
• Drift and delayed actions: new datasets that include long horizons, tool-result manipulation, retries, and reconnection after a session or role change.
• Dependency and code changes: reproducible benchmarks that measure review quality, exploitability, and false positives across ecosystems and package managers.
• Privilege and isolation: evaluations that vary identity, filesystem, network, and credential scope rather than testing a single default container.
• Telemetry and response: evidence that links detection quality to containment time, operator workload, and recovery outcomes in realistic workloads.

Watchlists are not predictions. They are a way to avoid silently treating a month’s papers as a permanent state of the field. When a provider, harness, or policy changes, rerun the relevant local tests and record the change in the release or incident log.

HOW TO REPRODUCE A CLAIM

A monthly finding becomes useful engineering evidence only when the team can state what would make it fail. Pin the model revision, system prompt, tool set, data fixture, evaluator, and runtime image used in the original experiment. Record whether the agent was read-only, what permissions it held, and how many repetitions produced the reported rate. Those details prevent a benchmark result from being silently compared with a different system.

Run a small local replication before changing a production policy. Start with the source scenario, then add controlled variants: a changed tool description, a delayed result, a revoked role, a malformed dependency, or a reconnect after timeout. Compare both the model outcome and the enforcement evidence. A safe answer with a missing denial log is not a passing control; likewise, a flagged trace without a containment action is incomplete assurance.

Store the replication as a dated record: source version, configuration hash, test cases, expected policy, observed decision, evidence links, and owner. If the result differs, preserve both outcomes and explain the boundary that changed. This turns research review into a repeatable feedback loop rather than a one-time headline, and it gives the next edition a concrete retest to report.

SOURCES

• EAL: Memory Laundering in LLM Agents, arXiv preprint submitted 2026-09-01.
• AgentDrift: Detecting Multi-Turn Tool-Use Drift, arXiv preprint submitted 2026-09-07.
• VEX-Bench: Verifiable Exploitability for Dependency Changes, arXiv preprint / EMNLP 2026, 2026-09-07.
• PrivEscalate: Evaluating LLM Agents in Privilege Escalation Scenarios, arXiv preprint submitted 2026-09-08.
• BlueSTAR: Threat Detection for Agentic IT/OT Operations, arXiv preprint submitted 2026-09-10.
• PermsAI AI Security Controls Matrix.
• PermsAI Frontier Model Evaluations.
• PermsAI AI Red Teaming.

Research notes: arXiv papers in this edition are preprints unless the ledger says otherwise. Findings are summarized from the linked primary records and should be rechecked when a version, venue, or benchmark implementation changes.