The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements
Md Jafrin Hossain, Mohammad Arif Hossain, Weiqi Liu, Nirwan Ansari
Why It Matters
What makes this one worth your time
As agentic AI systems are increasingly used in sensitive public domains, ensuring their safety and reliability is crucial to prevent harmful outcomes.
The paper identifies critical safety gaps in agentic AI frameworks and proposes solutions to enhance their security.
Summary
The paper evaluates the safety of agentic AI frameworks in public-facing applications, finding significant vulnerabilities in existing systems and proposing lightweight containment mechanisms to address these issues.
Key contributions
- Audit of three major agentic AI frameworks for safety compliance.
- Empirical validation of memory-poisoning vulnerabilities in a simulated environment.
- Introduction of two containment mechanisms to enhance framework security.
Notable insights
- Memory integrity is a significant vulnerability in current agentic AI frameworks.
- Lightweight containment mechanisms can effectively mitigate identified attack vectors with minimal performance overhead.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2606.12797v1 Announce Type: new Abstract: Agentic large language model systems that autonomously invoke tools, maintain persistent memory, and execute multi-step plans are increasingly deployed in public-facing domains, including government services, healthcare triage, and financial advising. We ask whether the frameworks used to build these systems provide architectural-level structural safety guarantees. Applying six containment principles derived from a compositional model of agentic architectures, we audit three dominant frameworks (LangChain, AutoGPT, and OpenAI Agents SDK) and find no native compliance in any of them. Memory integrity, a defense against one of the most prevalent vulnerability classes, is not observed in any of the three evaluated frameworks. We validate these findings empirically: in a simulated government benefits agent built on LangChain, a single memory-poisoning write induces persistent targeted corruption across all tested seeds and backends, increasing the wrongful denial rate for targeted applicants to 88.9%. Under a complex five-factor policy, the same attack preserves aggregate accuracy while increasing targeted wrongful denials by 3.5x, rendering the corruption difficult to detect through standard monitoring. We then introduce two lightweight containment mechanisms: a memory integrity validator and a policy gate, which eliminate both attack vectors with sub-millisecond overhead (<0.2ms per call). We conclude that the current agentic framework ecosystem may not yet meet secure-by-default expectations for public-facing deployments and outline priority architectural interventions to enable trustworthy deployment in high-stakes, socially impactful applications.