Daily digest · 2026-09-14

Daily Digest, 2026-09-14

TL;DR: Today's batch is mostly about proving what an agent actually did, and about the gap between what benchmarks claim and what they measure. A new record format argues agent logs are unusable as evidence because they can be edited, can't be replayed, and don't say whether secrets were stripped; two separate papers show benchmark validity decays across pipeline stages and that a real audit of agent eval files found metrics measuring the wrong thing. On the data side, researchers show that ordinary public posts can be aggregated into sensitive attributes with links back to the source, and that one unredacted prompt seeds personal data into memory, tool arguments and logs across an entire pipeline. Brussels also sent a US-EU biometric border-sharing framework to the Council ahead of a year-end Visa Waiver deadline.

Top stories

• NovaFabric proposes tamper-evident, replayable evidence for autonomous agent runs (arXiv cs.CR, 2026-09-14). Current observability traces are mutable and silent on whether captured secrets were redacted, which the authors say fails the record-keeping assumptions in the EU AI Act, ISO 42001 and NIST AI RMF. An agent log that holds unredacted personal data becomes its own exposure before it can serve as audit evidence.
• GraphProfiler builds personal knowledge graphs to infer sensitive attributes with source links (arXiv cs.CR, 2026-09-14). Aggregates indirect cues across many ordinary posts to infer age, income and occupation, linking each inference back to the content that supported it. Field-level redaction does not stop this, and inferred special-category data sits inside GDPR's scope.
• BodhiPromptShield mediates prompts before inference to stop PII spreading across pipeline stages (arXiv cs.CR, 2026-09-14). Raw user content flows into retrieval queries, memory writes, tool arguments, OCR text and logs, and every downstream copy inherits whatever the first write held. Document-boundary de-identification misses this entirely, so redaction has to sit ahead of the model call.
• Agent evaluation validity degrades multiplicatively across the pipeline (arXiv cs.AI, 2026-09-14). Benchmark scores are used to justify deployment decisions, safety certifications and compliance claims, and the paper bounds total validity by the product of three stage validities. Gives an assurance function grounds to push back on eval numbers offered as conformity evidence.
• Adversa: nearly every agent vulnerability it has published lives in the harness (Adversa AI, 2026-09-14). The loop, tools, context, approvals and sandbox account for almost all the firm's published agent flaws, not the model. That layer is also where controls over what an agent may read and send have to live.
• Computer-use agents pull data across app contexts in ways contextual integrity would forbid (arXiv cs.AI, 2026-09-14). Agents with standing access to a user's email, calendar and to-do apps surface information from one context inside another. That cross-app movement is the exact flow a permission model has to bind, and the thing a DPIA on a personal-assistant agent needs to describe.

Also notable

• AIM proposes a privacy-aware memory layer for multi-agent, multi-user LLM systems, memory isolation where several users share one substrate
• Certifying concept unlearning in text-to-image models, removal guarantees over prompts nobody tried, not just attack success rates
• Hessian-guided unlearning for erasure requests and poisoned records, fast deletion from trained models rather than waiting for retraining
• Agent evaluation audit finds a routing report whose numbers describe something other than its labels, what a real metrics audit turns up
• Survey measures clinicians running patient work through unapproved AI tools, shadow AI in healthcare
• Open-source end-to-end FHE implementation for Llama 3 8B inference, encrypted inference with no plaintext prompt at the provider
• Composing skill-registry scan verdicts with runtime consequence control, scanners overlap on at most 10.4% of flagged skills
• SecurityWeek: CISOs trying to rein in over-privileged agents, least privilege as the live control problem

Beyond AI

• EU sends a US biometric border data-sharing framework to the Council (Biometric Update, 2026-09-14). The Commission sent a finalized reciprocal identity and biometric checking arrangement to the Council on 10 September, asking for approval to sign and provisionally apply it before Washington's year-end Visa Waiver deadline. It sets the transfer and matching rules that face recognition and identity-inference systems on both sides will have to run inside.
• Newsom signs AB 1709, California's near-total social media ban for under-16s (EFF Deeplinks, 2026-09-10). The law was signed on 10 September; EFF and allied groups say it does not fix what is wrong with the platforms it targets. Enforcing it pushes platforms into age estimation and identity checks at scale, setting the data-collection baseline any AI product serving minors will have to meet.
• CNIL publishes guidance on data protection in France's e-invoicing rollout (CNIL, 2026-09-10). France's B2B electronic invoicing obligation took effect 1 September 2026 and the regulator set out its security and purpose expectations for the businesses now routing invoices through it. Mandatory structured invoice data through certified platforms becomes a large processing pipeline that automated fraud scoring and analytics will sit on top of.