AI agents built from separate security modules can still get hacked when those modules hand off control to each other -- a new paper proposes a fix.
Researchers describe a failure mode they call "security-context discontinuity," where authorization details get dropped, widened, or misread as an action moves between provenance trackers, policy engines, protocol adapters, and execution controls in an LLM agent pipeline. The individual security mechanisms are not the weak point; the seams between them are. Their framework, CONTINUITY, forces each component to carry authenticated context forward through signed grants, provenance records, and execution permits tied to a specific principal, task, and policy state. In tests spanning 32 fault classes across four application domains, the full CONTINUITY setup blocked all 2,560 simulated attack instances, completed all 700 legitimate tasks, and correctly flagged all 200 ambiguous cases for human review instead of guessing.
Most agent security work focuses on hardening individual pieces: better auth, better sandboxing, better policy checks. This paper's contribution is showing that stitching those pieces together is its own attack surface, one that gets riskier as agents chain more tools and hop across more services. That is exactly the direction agent frameworks are already heading, so the seams problem will only grow before it shrinks.
A reference verifier passing a fault-injection suite is a promising academic result, not a production guarantee -- the real test is whether anyone shipping agent frameworks bothers to adopt contracts like these before the seams get exploited outside the lab.