ACE Frontier Research
Beyond Identity
The Emerging Authority Layer for Autonomous AI Systems
Long-horizon hypotheses
Frontier Research
Control evidence
Evidence Notes
ACE-RN-2026-020 · Misuse resistance
A Model That Refuses Everything Is Not Safe
A system can score well on a one-sided harmful-prompt test by refusing every request while remaining unusable and leaving tool misuse, privacy leakage, or adversarial bypass untested
ACE-RN-2026-019 · Data handling safeguards
Refusal Is Not Unlearning
A model's refusal to answer a probe is behavioral output evidence; it does not prove removal from parameters, adapters, retrieval stores, caches, memories, checkpoints, or derivative datasets
ACE-RN-2026-018 · Cost and loop containment
Invisible Prompt Injection Inside Encrypted Reasoning
Encrypted, encoded, hidden, or dynamically assembled content can carry instructions that are invisible to a human reviewer but become executable context when an agent decodes or consumes it
ACE-RN-2026-017 · Data handling safeguards
Private Data Hidden Inside Published Agent Traces
A clean final response can coexist with personal or confidential data in tool arguments, observations, memory, errors, metadata, attachments, or intermediate agent messages
ACE-RN-2026-016 · Misuse resistance
Safe Final Answer, Hazardous Hidden Reasoning
A final answer can look compliant while intermediate reasoning contains harmful instructions, deceptive intent, privacy-sensitive content, or a plan that later tool actions execute
ACE-RN-2026-015 · Uncertainty disclosure
Encrypted Reasoning That Is Not Bound to Its Owner
An opaque reasoning block can preserve confidentiality at rest yet remain replayable across users, sessions, or compatible models if it is not bound to owner and context
ACE-RN-2026-014 · Misuse resistance
Synthetic Reasoning Theft Without Reasoning Traces
A black-box API can transfer useful reasoning capability through final answers and summaries even when it never returns the victim's private chain of thought
ACE-RN-2026-013 · Human approval integrity
The Approval Button Is Not Authorization
A click records an interface event but does not prove that the reviewer was authorized, saw the final action and evidence, understood the scope, or that the backend enforced the approved object
ACE-RN-2026-012 · Decision evidence completeness
Explanations That Did Not Cause the Decision
A plausible explanation generated after an answer can be insensitive to the factors that actually changed the model's decision and therefore cannot be treated as a causal record
ACE-RN-2026-011 · Decision evidence completeness
Logs Are Not Proof
Ordinary logs can omit relevant events, accept mutable free text, lack actor or policy context, and be rewritten by the same system whose conduct they are meant to establish
ACE-RN-2026-010 · Decision evidence completeness
A Real Citation Can Still Support the Wrong Claim
A DOI, URL, or paper can be real while the cited span does not entail the atomic claim, applies to a different population or date, or supports only a weaker qualified statement
ACE-RN-2026-009 · Decision evidence completeness
A Decision Without Its Evidence
A record that stores only approve or deny and a free-text reason cannot prove which inputs, policy version, alternatives, evidence artifacts, and authorized approver existed at decision time
ACE-RN-2026-008 · Tool & data authorization
When Tool Metadata Becomes an Instruction
Tool descriptions, annotations, schemas, and returned metadata can contain attacker-controlled text that the model interprets as instructions rather than untrusted data
ACE-RN-2026-007 · Tool & data authorization
The Over-Tooled Agent
An agent can expose too many tools, overly broad tool functions, or credentials whose effective permission closure exceeds the current task
ACE-RN-2026-006 · Tool & data authorization
Tool Access Is Not Data Authority
A tool being visible, schema-valid, and technically able to reach a record does not prove that the current principal authorized this concrete resource, parameter, purpose, and destination
ACE-RN-2026-005 · AI identity attribution
One API Key, Many Agents
Multiple agents using one API key collapse distinct software identities, tasks, principals, and authority boundaries into a single credential holder
ACE-RN-2026-004 · AI identity attribution
Who Did the Agent Act For?
An action can identify the immediate workload yet fail to preserve the human or service principal, delegation purpose, and actor chain on whose behalf the agent acted
ACE-RN-2026-003 · Delegated authority containment
Replay Without Authority
A bearer artifact can be copied from an authorized exchange and replayed by a different process, session, audience, or time window without re-establishing the authority that justified the original use
ACE-RN-2026-002 · Delegated authority containment
Revoked Here, Active There
A revocation accepted by the issuer can remain invisible to a cached resource server, regional gateway, derived credential, or already-running agent after the declared containment deadline
ACE-RN-2026-001 · Delegated authority containment
Authority Must Shrink, Not Grow
A child agent can receive a credential whose effective resource, action, audience, tenant, time, or budget scope is broader than the authority its parent was allowed to delegate
Historical and benchmark publications
Papers & Archive
ACE-272
A Retrospective Benchmark of Enterprise Trust Risks in Language-Model Endpoints.
Download paper →Long-Context Benchmark
Long-context reliability, evidence preservation, and operational failure boundaries.
View reports →ACE Governance & Compliance Benchmark
The frozen ACE Benchmark v1.1 Technical Whitepaper and its historical methodology record.
Download archived whitepaper →