Signed but Not Safe separates two failures: changing a handoff in transit and changing what an orchestrator decides to sign. Its signed design extracts quoted requirements and checkable predicates, authenticates canonical JSON with HMAC-SHA256, and uses deterministic verification of the downstream decision. The Qwen3-8B study comprised 1,440 trajectories.…
Inspect the ClaimsCase · DiggingBeagle record
Signed agent handoffs preserved bytes, not necessarily the user's requirements
A preregistered study found that signed manifests reduced unsafe commits in a specified Qwen3-8B comparison. Corrupting requirements before signing could still produce an authentic manifest that misrepresented user intent.
Public disclosure: Nov 5, 2026
Scope
Research reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-HANDOFF-SIGNED-RESULT · CLM-HANDOFF-PRESIGN-BOUNDARY · Study of presign authorization contamination in agent requirements
At a glance
Cryptographic integrity protects transport, not semantic authorization or correct requirement extraction.
Read the implicationsSynthetic exactly scorable cases and selected models, not a measured real corporate intrusion or deployment result.
Limits and uncertaintyFull account
Signed but Not Safe separates two failures: changing a handoff in transit and changing what an orchestrator decides to sign. Its signed design extracts quoted requirements and checkable predicates, authenticates canonical JSON with HMAC-SHA256, and uses deterministic verification of the downstream decision.
The Qwen3-8B study comprised 1,440 trajectories. In the prespecified attacked comparison across 144 paired tasks, unsafe commits fell from 69.4% with structured handoffs to 9.0% with signed manifests. The percentages describe that comparison, not a pooled rate over every trajectory and threat condition.
The earlier boundary remains exposed
A separate pre-signing test manipulated the context used for requirement extraction. An incorrect requirement could then receive a valid authenticator. Rejecting later byte changes cannot establish fidelity to an original request that the extraction step has already distorted.
The practical implication is to distinguish transport integrity from semantic authorization, including comparison with an independently retained authenticated user request. This is an architectural inference, not a deployed protection measurement. The reported percentages apply to the specified synthetic tasks and model configuration; they do not establish universal benefits across stronger models, extraction formats or production teams.
Mechanism and trust boundary
- 01
An orchestrator extracts original requirements, builds a canonical JSON manifest and attaches a signature.
- 02
A verifier rejects transit mutation, while a malicious or confused upstream extraction may insert an incorrect requirement before signing.
- 03
A downstream executor sees a valid signature for a potentially altered statement of user intent.
Claims & evidence
CLM-HANDOFF-SIGNED-RESULTThe Qwen3-8B study comprised 1,440 trajectories. In its prespecified T2a-through-T4 attacked contrast over 144 paired tasks, unsafe commits fell from 69.4% with structured handoffs to 9.0% with signed requirement manifests. The 69.4% and 9.0% figures are not pooled rates across all 1,440 trajectories.supported
Basis: reported finding
- supportsStudy of presign authorization contamination in agent requirementsprimary disclosure
arXiv:2611.07483, abstract; Section 6.2 and Table 3, H1 contrast, T2a-T4, n=144 pairs
CLM-HANDOFF-PRESIGN-BOUNDARYThe authors separately tested pre-signing injection and report that a valid HMAC authenticates the resulting manifest, not the fidelity of its content to the user request.supported
Basis: reported finding
- supportsStudy of presign authorization contamination in agent requirementsprimary disclosure
Section 6.6 Pre-signing injection (T5) and Discussion: signatures are not intent fidelity
Implications
Cryptographic integrity protects transport, not semantic authorization or correct requirement extraction.
Controls and mitigations
- Keep authenticated original user requirements separately, validate extracted predicates against the original evidence and verify consequential tool arguments before dispatch.
Unknowns and contradictions
- Synthetic exactly scorable cases and selected models, not a measured real corporate intrusion or deployment result.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233