Abstract

Right Name, Wrong Target: Stopping AI Agents From Acting on the Wrong File, Tenant, Tool or Model — Tool Integrity, Semantic Target Correspondence and Execution-Time Resource Identity for iOS, Android and Cloud Agents

Abstract (Part 7)

“Share this document.” “Pay the plumber.” “Turn off the bedroom light.” “Deploy to production.” Every agent request depends on references that must be resolved, and every resolution can quietly go wrong. Four values are routinely treated as one: what the user saw on screen, what the language model understood, what an alias or URL resolved to, and what actually executes. In practice they can drift apart:

  • a selection can shift;
  • a document can be renamed;
  • a payee alias or DNS name can be rebound to another account or tenant;
  • a tool can change its behaviour after approval;
  • a model or configuration can be swapped;
  • a plugin can be updated or rolled back;
  • a service can be silently substituted;
  • instructions hidden in web pages, repositories or tool outputs can steer the next call.

Authentication, a signed permission, a matching API schema or a successful tool response proves none of this.

This disclosure keeps every consequential agent action non-effective until a protected Finality Sink reconstructs what will actually execute and proves it matches what was authorised. It covers seven mechanisms:

  1. binding a user reference and its presentation evidence to a stable object identity and version;
  2. authenticated, versioned tool-effect contracts, so a changed tool cannot act under an earlier approval;
  3. approved model, algorithm and configuration baselines;
  4. authenticated alias-to-resource resolution with binding generations, plus tenant and redirect checks;
  5. instruction provenance, so untrusted content can never enlarge source authority;
  6. monotonic tool install, upgrade and rollback generations that fence queued requests;
  7. dynamic service-identity and capability-substitution checks against the actual receiving resource.

Any unverified or incompatible predicate keeps the act non-effective. Consumption is single-use and crash-safe. Attestation and signatures are treated only as the evidence they actually provide.

The disclosure includes key points for examiners with search terms, architecture and decision-gate drawings for each embodiment, reference schemas and state machines, twelve implementation variations, a twelve-threat model, thirty proposed validation tests, and IETF and EU AI Act mappings.

Industry relevance (AI-generated): the patterns apply to publicly described environments, including:

  • Apple iOS, iPadOS, macOS, Siri, Shortcuts and App Intents
  • Google Android, Gemini, Intents, Binder, Keystore, Google Cloud and Kubernetes
  • Samsung Bixby; Microsoft Windows, Azure, Agent Framework and Copilot; Amazon Alexa
  • OpenAI Codex, Responses API, Agents SDK and computer use; Anthropic Claude Code and managed agents
  • Meta Muse/Sentinel; NVIDIA OpenShell, Sentry and BlueField; Qualcomm Snapdragon and Arm-based devices; Huawei ecosystems
  • Model Context Protocol servers and agent-to-agent registries; browser agents; payments and agentic commerce
  • Matter smart-home devices; Apple CarPlay and Android Auto; the EU Digital Identity Wallet

Names identify integration environments only. No vulnerability, deficiency, implementation or infringement is alleged, and no endorsement is implied. This material is AI-generated and must be cross-checked against the original PCT filings and primary sources before drawing any conclusion.

This technical disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026 (WO 2026/150382), which claims priority from PCT/IB2026/053385, filed 7 April 2026 and publicly disclosed 4 June 2026 (WO 2026/115520). The source text corresponds to Embodiments 3, 6, 10, 21, 24, 26 and 34 at pages 435–492, 666–722, 926–994, 1758–1829, 2019–2091, 2169–2245 and 2914–3005 of the 3,567-page specification published on Zenodo (https://zenodo.org/records/23657985); those page numbers refer to that specification, not to the PCT page count. It is expanded here from Internet-Draft draft-das-agent-tool-integrity-00, dated 26 October 2026 (Part 7 of a 12-part series). Diagrams, schemas, implementation variations, threat classifications and proposed tests are newly authored explanations, not claimed as filed content or experimental results. Related family applications can be cross-checked on WIPO PATENTSCOPE. Licensed under CC BY-NC 4.0. The author is open to acquihire or strategic collaboration.

Keywords

AI agent tool integrity; confused deputy; prompt injection; indirect prompt injection; tool poisoning; MCP server security; tool description tampering; rug pull; semantic target correspondence; user-referenced object; alias rebinding; DNS rebinding; cross-tenant redirect; service substitution; tool contract versioning; model swap; configuration drift; plugin update fencing; rollback attack; dependency substitution; computer-use agent; browser agent; App Intents; Android Intents; Binder; Kubernetes service discovery; payee identity; execution finality; Finality Sink; EU AI Act.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS