Before the Next Move

An agent's next action is shaped before a tool call ever leaves the model. What it retrieves, what it accepts as state, what the surrounding system can prove, and which capability it chooses all influence the action that follows.

Four newly surfaced papers examine those decision surfaces from different directions. MAFIA shows that malicious memory records can survive write-time auditing and later win retrieval. TARL argues that persistent memory needs richer transition semantics than write or ignore. A formal-verification framework moves assurance from isolated calls to the evolving operational data they change. Canary Tools turns tool-selection mistakes into named, testable failure modes.

Together they point to a more practical question than whether an agent can complete a task: what happened immediately before the commitment, and was that precursor state trustworthy enough to act on?

MAFIA, TARL, and the formal-verification paper were submitted to arXiv on August 4 and were retained through Keelbase Signal's standing catch-up review. Canary Tools was submitted August 5 inside the strict August 5 01:00–August 6 01:00 UTC window. None is presented as an August 6 publication.

A clean memory write can become a dangerous retrieval

Memory poisoning becomes harder to catch when an attacker cannot write directly to a memory store and must instead induce an agent to create the record through ordinary interaction. MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents studies that setting under two additional pressures: the malicious record must pass an input audit and must later compete with a large pool of benign memories for limited retrieval slots.

MAFIA combines retrieval-aware placement with compact factual payloads designed to remain semantically close to later target queries. In the authors' evaluated settings, the attack reaches as high as 90.7% attack success while highlighted audit-detection results fall to at most 7.4%. The paper also tests several retrievers, model backbones and memory pools rather than assuming that a poisoned record will automatically be surfaced.

The important result is not a universal attack percentage. It is the demonstrated separation between two security questions: whether a record looks suspicious when written and whether it becomes influential when retrieved. A memory item can cross the first boundary cleanly and still become the decisive context for a later action.

The authors' defense discussion therefore goes beyond per-record prompt inspection. It points toward write isolation, provenance, consistency checks and verification after retrieval. Those controls address different stages of the memory lifecycle rather than assuming one admission filter can settle future safety.

MAFIA remains an adversarial preprint evaluated on specific agent, dataset, retriever and auditor combinations. Its results should not be generalized to all memory systems, and stronger auditing or different retrieval architectures can change the attack surface.

Persistent memory needs security controls around retrieval as well as admission, because a record that looks acceptable when stored may become dangerous only when it is selected later.

Source: MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents (opens in a new tab), submitted August 4, 2026.

Memory updates need verbs, not a binary switch

Long-term memory systems often reduce updating to a simple question: write the new information or hold the existing state. TARL: Transaction-Aware Reliable Ledgers for Executable Memory Management in Long-Term Agents argues that this collapses materially different situations into the same label.

TARL maps incoming statements to five executable operations: append, noop, revise, reject_conflict, and defer_verify. It identifies which memory is affected, resolves temporal scope, compares source reliability and routes evidence across accepted, pending and rejected ledgers. The framework is trained by comparing the memory states produced by alternative update operations rather than treating the decision as text classification alone.

That distinction matters because new evidence can be compatible with existing state, supersede it, contradict it without sufficient authority, or remain unresolved pending more evidence. Treating all of those outcomes as write versus ignore can discard information needed to reconstruct why the current state exists.

TARL is research on memory-state management rather than a complete governance ledger. Its experiments do not establish that the framework can determine truth, resolve arbitrary source conflicts or supply legal provenance. The useful contribution is the explicit transition vocabulary and preservation of evidence that does not immediately become authoritative state.

Persistent state should record what kind of change occurred, not merely whether new information was stored.

Source: TARL: Transaction-Aware Reliable Ledgers for Executable Memory Management in Long-Term Agents (opens in a new tab), submitted August 4, 2026.

Verify the workflow state, not just the call

A tool call can satisfy an interface rule while the business process around it remains wrong. Formal Verification of Agentic Systems over Operational Data models a deployment as an LLM agent, a tool-orchestration harness and persistent relational data whose state changes over time.

The authors call these systems Stateful Tool-Enabled Agentic Deployments, or STEADs. Business requirements are expressed over the evolving data using First-Order Computation Tree Logic. The general verification problem is undecidable, but the paper identifies sufficient symmetry and boundedness conditions under which exact verification can be reduced to a finite-domain problem that is PSPACE-complete.

One key condition is equivariance under opaque identifier renaming: consistently renaming identifiers in the state should produce the correspondingly renamed tool choice. The authors show that LLM-driven agents can violate this requirement. They therefore introduce a wrapper that canonicalizes equivalent decision contexts before presenting them to the model, then maps the chosen call back to the original identifiers. Computing the required canonical representations is itself graph-isomorphism-hard.

The worked case-management example includes both progress properties and an authorization-style requirement: a consequential action must be preceded by the required approval in persistent state. This makes the paper relevant to agent governance because it treats authorization as a property of the evolving workflow rather than of one isolated API invocation.

Its boundaries are unusually important. The paper does not prove that arbitrary LLM agents can be formally verified. Exact verification depends on the authors' finite-domain restriction and structural conditions on tools, policies and state evolution.

Assurance over consequential workflows must cover the persistent operational state an agent changes, not only the syntax of individual tool calls.

Source: Formal Verification of Agentic Systems over Operational Data (opens in a new tab), submitted August 4, 2026.

Tool errors have recognizable shapes

Choosing the wrong tool is often scored as a single failure even though the underlying reasoning error can differ substantially. Diagnosing Tool-Selection Reasoning in LLM Agents with Canary Tools introduces diagnostic tools that are intentionally attractive for different wrong reasons.

The benchmark organizes those traps into six categories: semantic decoys, parameter traps, capability mirages, prerequisite blindness, temporal decoys and granularity traps. The purpose is not to give an agent more capabilities, but to expose which kind of tool-selection reasoning breaks when plausible-but-wrong choices are available.

The study evaluates eight models and reports that general model tier does not reliably predict tool-selection robustness. In particular, capability-mirage descriptions remain effective against strong models: a tool can sound as though it provides a needed function without actually supporting the required operation.

That is useful for deployment because a tool registry is not a neutral menu. Names, descriptions, parameter schemas, prerequisites and overlapping capabilities all shape agent selection. Evaluation that measures only end-task success can hide a recurring weakness until a production registry presents the same kind of decoy.

Canary Tools remains a benchmark rather than a runtime control. Its taxonomy does not prove that six categories exhaust real tool-selection failures, and results depend on the tested models, prompts and tool environments.

Tool-use evaluation should test the specific reasoning traps created by a deployment's capability surface instead of treating general model strength as a proxy for safe selection.

Source: Diagnosing Tool-Selection Reasoning in LLM Agents with Canary Tools (opens in a new tab), submitted August 5, 2026.

Inspect the precursor state

These papers converge on a part of agent execution that is easy to compress away. The final action is visible, but the precursor state that made it appear reasonable may not be.

• MAFIA asks which memory record won retrieval before reasoning began.
• TARL asks which state transition made that memory authoritative.
• STEAD verification asks whether the surrounding operational state satisfies the workflow's actual requirements.
• Canary Tools asks why one capability looked preferable to the alternatives.

Several adjacent papers reinforce the same direction without requiring additional records. SafeCommit studies whether a side-effectful action is safe across a calibrated set of plausible states before committing it. EviGraph preserves typed evidence relationships and repairs dependent claims when upstream evidence fails. ContextWeave shows that richer workflow memory can improve continuation while increasing exposure to misleading recall. A separate chain-of-thought monitoring study reports weaker detection when behavioral influence is implicit rather than explicitly instructed.

The lesson is not that one new verifier can make agents safe. It is that pre-action state has multiple layers with different failure modes. Memory admission, memory transition, operational-state verification and tool selection each need their own evidence and controls. By the time a consequential tool call is emitted, several earlier decisions may already have determined the outcome.

Sources and limitations

All four primary records are preprints and should be treated as author-reported research rather than settled findings. Three were retained through the standing catch-up review horizon; Canary Tools was submitted inside the strict daily window. Supporting papers inform the synthesis but are not separate Signal records in this edition.

• MAFIA (opens in a new tab)
• TARL (opens in a new tab)
• Formal Verification of Agentic Systems over Operational Data (opens in a new tab)
• Canary Tools (opens in a new tab)
• Supporting: SafeCommit (opens in a new tab)
• Supporting: EviGraph (opens in a new tab)
• Supporting: ContextWeave (opens in a new tab)
• Supporting: Chain-of-Thought Monitoring Can Be Unreliable in Implicit-Influence Settings (opens in a new tab)