Signature on task lists cuts dangerous agent steps from 69% to 9%

Researchers tested a method to keep user requirements safe when AI agents give work to each other. Software puts a signature on a list of requirements. Other software checks the last decision against the list. With the Qwen3-8B model, in 1,440 tests, dangerous commits during attack decreased from 69.4% to 9.0%. The tests used synthetic tasks.

How it works

The orchestrator (the agent that divides the work) gives each requirement as a quote and a rule that software can check. Code puts a signature on the list with HMAC-SHA256, a standard seal against change. Code without AI then checks the decision of the merger.

The numbers

A list without a signature had violations in 79% of the changed tests. The list with a signature had none. The code check found 78.7% of the decisions with violations, against 59.0% for an AI check. Incorrect alarms were 7% against 50%.

What is not known

Errors made before the signature continue. One bad line increased violations from 8.3% to 75.0% on GPT-5.6-luna. The signature then approved the bad list. The authors tell that the extraction step is the trust boundary.

Insight: A signature protects a requirement only after it is written

Proof introduced x401, an open protocol for agent authorization. In it, a changed term breaks the signature. NIST got 650 answers on how to show who approved an agent task. This paper shows that a signature protects transit, not extraction. A signature moves the work to the step that writes the requirement, and the company that controls that step controls what gets a signature. Find out who can change that step.