Security papers — 2026-10-23

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

Today we are diving into how to stop agents from misusing user secrets when they interact with APIs and cloud services. This is a major security concern because current defenses only look at isolated pieces of the puzzle.

The Secret-Use Delegation Protocol or SUDP aims to solve this problem. It ensures that an untrusted agent cannot gain reusable authority over a user's secret-backed operation. This method proposes that the user authorizes an operation and a custodian redeems it for bounded use SUDP.

This protocol is specialized for LLM-driven agents. Under standard cryptographic assumptions, it satisfies six out of seven required security properties. The last property is closed by combining SUDP with a hardware-rooted runtime.

Trust challenges in decentralized AI ecosystems are also heating up as agents move across organizational boundaries. Specifically, the ERC-8004 protocol provides a permissionless trust layer for AI agent economies using on-chain registries for identity and reputation Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem.

However, empirical testing shows that the current registry system is weak. Most registrations are placeholders and reputation values are not commensurable, which leads to coordinated Sybil behavior among reviewers.

There is also a gap in how we evaluate autonomous cyber defense systems when they interact with commercial tools. The evaluation framework for autonomous defense agents hardening commercial EDR products reveals that telemetry is often engineered for SOC analysts rather than policy effectiveness Closing the Sim-to-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR.

This suggests that simply testing against black-box tools does not capture the real operational effectiveness of these agents in a real enterprise setting.

Finally, concerning the integrity of AI output itself, topic-based watermarking offers a lightweight way to embed detectable signatures into generated text Topic-Based Watermarks for Large Language Models. This method partitions vocabulary into topic-aligned subsets to embed marks while preserving fluency. It shows results comparable to leading systems with minimal overhead.

Today's papers

SUDP: Secret-Use Delegation Protocol for Agentic Systems Agentic systems now act with user secrets for APIs, messaging platforms, and cloud services. [paper] [episode]
Closing the Sim-to-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR Leading commercial endpoint detection and response (EDR) products have shifted from operator-configured rule sets to multi-component systems where autonomous AI components operate alongside, and increasingly in place of, operator-deployed policies. [paper] [episode]
Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem As autonomous AI agents increasingly transact across organizational boundaries, a fundamental trust challenge emerges: how can an agent assess whether an unknown counterpart is trustworthy? [paper] [episode]
An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware Embedded devices powering cyber-physical systems (CPS) are increasingly internet-exposed, placing critical infrastructure under active threat. [paper] [episode]
Topic-Based Watermarks for Large Language Models We propose a lightweight, topic-guided watermarking scheme for LLMs that partitions the vocabulary into topic-aligned token subsets. [paper] [episode]

The papers

Topic-Based Watermarks for Large Language Models — The gist The proposed Topic-Based Watermarking (TBW) scheme offers a lightweight, topic-guided method for embedding detectable signatures into Large Language Model output by partitioning vocabulary into topic-aligned token subsets based on an input prompt's semantics. [episode]
SUDP: Secret-Use Delegation Protocol for Agentic Systems — The gist: SUDP proposes a Secret-Use Delegation Protocol to allow untrusted agents to cause user-authorized secret-backed operations without gaining reusable authority over them. [episode]
Closing the Sim-to-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR — The gist: This paper presents an evaluation framework for autonomous defense agents hardening commercial EDRs by instantiating it in a Game of Active Directory lab with Horizon3.ai’s NodeZero as the autonomous pentester and Microsoft Defender XDR as the EDR, reporting three les [episode]
Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem — The gist The ERC-8004 protocol addresses how autonomous AI agents can assess whether an unknown counterpart is trustworthy by providing an on-chain trust layer built around three registries: Identity, Reputation, and Validation This empirical study of ERC-8004 across Ethereum, BS [episode]
An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware — The gist The SaMOSA Linux sandbox provides a modular and customizable framework for emulating Linux malware while capturing time-synchronized side-channels from four sources. [episode]

Important terms

Secret-Use Delegation Protocol (SUDP): A protocol designed for LLM agents to prevent them from misusing user secrets by ensuring they only get bounded, authorized use of those secrets through a custodian.
ERC-8004: A permissionless trust layer for AI agent economies that uses on-chain registries to manage the identity and reputation of agents across decentralized systems.
Sybil behavior: When multiple fake identities are used in a system to gain an unfair advantage, often seen in registry systems where registration is easy but reputation is not properly measured.
Topic-Based Watermarking: A lightweight method for embedding detectable signatures into AI-generated text by partitioning vocabulary based on specific topics while keeping the output fluent.