I work on the governance, safety, and security of LLM agents — in
particular, lightweight in-band mechanisms that let infrastructure communicate policy
to autonomous agents, and empirical measurement of whether agents honor such signals.
93% of real coding-agent sessions interleave multiple threads, and about half of each
prompt's context belongs to others. A pre-registered four-arm ablation: thread-scoped context
matches full context at ~45% less — and full context is as often harmful as helpful.
(DOI)
An agent's memory can be poisoned and persist across sessions. memorywire ships
recover — detect, purge, quarantine, verify — and
(PurgeBench) scores it: provenance is
the strongest recovery lever; content anomaly detection barely beats doing nothing; the
entangled case remains open.
Two failures — obeying an illegitimate in-band signal, and ignoring a legitimate
one — are mirror images on a single legitimacy axis. A benchmark
(signalbench) measures both
across six frontier models; none exceed 0.85.
Research interests
Large Language Model agents
AI agent governance
AI safety
Access control
Computer security
Publications
Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals
A published mini-standard — the Recuse Signal — that lets a server ask a
connecting LLM agent to voluntarily withdraw, with the first measurement of whether
compliant agents honor it. Code: github.com/mthamil107/Recuse.
memorywire: A Vendor-Neutral Wire Format for Agent Memory Operations