{"type":"post","id":"study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62","slug":"study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62","title":"Study: LLM agent handoff summaries can invent unsupported permissions and restrictions","description":"A study of synthetic tool-use tasks finds that LLM agents’ handoff summaries sometimes state permissions or restrictions unsupported by the task record.","retrieval_nugget":"A study of synthetic tool-use tasks finds that LLM agents’ handoff summaries sometimes state permissions or restrictions unsupported by the task record. The findings suggest that summaries can become an accidental policy channel in long-running workflows, while also showing that the measured effects are limited and some behavioral results are exploratory.","published_at":"2026-11-06","updated_at":"2026-11-06","record_date":"2026-11-06","date_kind":"published_at","topics":["agent-security","tool-use"],"entities":["Wenhui Chu","arXiv"],"related_patterns":["agent-security-moves-to-runtime-boundaries"],"novelty_label":"new_fact","what_changed":"A separate study quantifies unsupported permissions and restrictions in agent handoff summaries, tests their effect on successor actions, and finds that clearer system-prompt guidance reduces false restrictions.","prior_refs":["https://newruntime.com/posts/compaction-laundering-forging-the-user-one-summary-at-d810b8/"],"source_url":"https://arxiv.org/abs/2611.06545","source_urls":["https://arxiv.org/abs/2611.06545"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62/","markdown":"https://newruntime.com/posts/study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62.md","json":"https://newruntime.com/posts/study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62.json"},"markdown_url":"https://newruntime.com/posts/study-llm-agent-handoff-summaries-can-invent-unsupported-cdaa62.md","next_reads":[{"type":"topic","path":"/topics/agent-security/","url":"https://newruntime.com/topics/agent-security/","title":"Agent Security","reason":"Explore the agent-security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/agent-security.md","json_url":"https://newruntime.com/topics/agent-security.json"},{"type":"topic","path":"/topics/tool-use/","url":"https://newruntime.com/topics/tool-use/","title":"Tool Use","reason":"Explore the tool-use topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/tool-use.md","json_url":"https://newruntime.com/topics/tool-use.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/sources/","url":"https://newruntime.com/sources/","title":"Sources","reason":"See the original sources this archive cites.","media_type":"text/html"}]}