Stopping Harmless-Looking Steps Before They Run ── SEAD recasts attack and defense in tool-using agents as a problem of hidden state

1. Why a harmless-looking step can cause harm

Language-model agents now edit files, change permissions and update database records. Once an agent acts on external systems through tools, whether a given action is safe can no longer be judged from the action alone. An earlier step can change the state of the system so that a later, routine-looking step becomes harmful.

The visible exchange between user and agent shows only instructions and replies. What has happened to files and permissions underneath is not shown. That is why defenses that read the conversation and reject dangerous-sounding requests struggle here, and why this paper puts the hidden state at the center of the problem. The primary source is a preprint posted on arXiv; it has not been peer reviewed.^[1]

2. The core idea: attack and defense as the same partially observed control problem

Under the name SEAD, the authors formulate both attack and defense as control of a state that can only be partially observed. Because attacker and defender act on the same execution process, the design requirements of each can be derived from that shared process.

The attack method is called DART. An attacker can only supply instructions; the target agent chooses the concrete actions. DART therefore breaks a harmful goal into steps that each look plausible on their own, and uses feedback from real tool execution to steer its search over action sequences.

The defense method is called SAGE. A defender must allow or block each action before it runs, with incomplete evidence about the state. SAGE therefore investigates the relevant state through read-only queries before deciding. It applies the same check to the replacement actions an agent proposes after being blocked.

3. What the abstract reports

For evaluation, the authors built a dataset with controlled initial states, replayable tool environments and task-specific executable checks. The point of this design is that success is judged by whether harm actually occurs in the environment, not by whether an output looks harmful.

On the attack side, across four target models, DART raised semantic attack success by 18.8 to 35.9 percentage points over the competing baseline, and the gains held under executable verification.

On the defense side, on recorded trajectories SAGE let through 95.79% of benign trajectories while intercepting 92.73% of harmful paths by the harm-enabling boundary. In online attack-defense evaluation, it cut DART's executable attack success from 48.0% to 4.0%. The authors state that SAGE stayed effective across four attack methods and generalized to out-of-domain environments. These are results within the paper's own experiments; they are not established performance guarantees.

4. A worked example: an agent operating a document management system

Consider an agent that operates a company's document management system and receives several requests over a few days.

Read on its own, neither request raises a flag. The harm arises only where the state created by Request A meets the action in Request B. SAGE is aimed at spotting that overlap before execution. Checking the fallback proposed after a block also matters in this example.

5. What is not new, and what the abstract leaves open

Checking the current state and permissions before an operation is an old idea in information security. Access control and the principle of least privilege exist precisely to decide, before execution, who may touch what and under which conditions. The contribution here reads less as a new idea than as a single framework that treats attack and defense on consecutive agent actions together, plus an evaluation environment where outcomes can be checked by execution.

Several limits cannot be resolved from the abstract. First, the defense figures also imply that some benign trajectories are blocked. How a legitimate operation that has been stopped gets released, and by whom, is outside what the abstract covers.

Second, the abstract does not state the time or cost of the read-only queries, or how far those queries are allowed to look. If the read access granted for checking is too broad, it becomes a new exposure in its own right.

Third, the opponent in the online evaluation, DART, is the authors' own attack. The abstract says SAGE held up across four attack methods, but it does not list them, nor does it name the four target models. How far the out-of-domain environments are from the training domain is also not stated.

Fourth, publishing an attack method is necessary for testing defenses, but it also leaves room for the same procedure to be reused for misuse. The abstract does not say how this is handled.

6. Why this topic is clustering now

In the same window, another arXiv paper on the safety of tool-using agents appeared: ToolFence. As far as its title shows, it works on fine-grained authorization for the tools an agent may use.^[2] SEAD approaches the problem from the side of checking state and blocking before execution; ToolFence approaches it from the side of narrowing what permissions are granted in the first place. The cluster size is 2.

The attention figures are modest: 2 upvotes and 3 comments on the paper-sharing page, and 1 star on the code repository.^[4][3] The paper was picked up here because of the comment activity and because a separate group posted work on the same question. Both are signs that a topic is being discussed. Neither shows that the claims are correct or that the work is important.

7. Where this connects to pharmaceutical and regulatory practice

In pharmaceutical work, changes to documents and data come with access control and records. Regulatory thinking on the reliability of electronic records assumes that one can trace afterwards who changed what and when. An audit trail, however, is a way to check what happened after the fact. It is not a mechanism for deciding, just before an operation, whether that operation is acceptable in the current state. SEAD addresses that pre-execution decision.

When an agent is given document management or the handling of promotional materials, the risk does not sit in the wording of each operation. It sits in the combination of each operation with the state that earlier operations have built up. Unapproved material leaking out, or access quietly widening, both take the form of ordinary steps when viewed one at a time.

Seen this way, the paper spells out what should be checked before connecting agents to business systems. What counts as harmful, and which state counts as the harm-enabling boundary, remains a decision for the people accountable for the work, not for the defense mechanism. If the criteria themselves are generated automatically, things that should be stopped may pass. Given that this is research at the preprint stage, it is best read as material for thinking about system design.