The [un]prompted II Vocabulary: 24 Terms From the Agenda, Defined

[un]prompted II, which many people type as "unprompted", introduces a vocabulary faster than the field can absorb it. This page lists 24 terms from the programme, with who presented each one. It is the companion to our [un]prompted II conference guide, so read that first for the schedule.

The terms come from the official agenda for the October 27-29, 2026 event in San Francisco, read on 2026-10-12. The agenda can change. We are independent coverage, we are not the organiser, and we are following remotely. The conference has not happened, so each entry reports what a published abstract claims, never what a speaker said. Definitions of new terms are contested. Where the abstract does not define a term, we say we are interpreting. Where a term is general industry vocabulary, we say that and credit no one.

Terms, defined: the [un]prompted II vocabulary

CxBOM (context-window bill of materials)

CxBOM is a bill of materials for the context window. The abstract for "All Tokens Are Created Equal, Including the Attacker's" says Rock Lambros (Zenity) and Fred Wilmot (Detecteam) release it, with a live demo, on Day 1 Stage 2. The abstract frames it against the EchoLeak zero-click Copilot exploit, and says models do not distinguish trusted tokens from untrusted ones. The name echoes SBOM, so our reading is a manifest of what entered the context and where each piece came from. The abstract does not publish a schema, so that reading is ours. A manifest records inputs. It does not stop a model from obeying a hostile one.

Context provenance

Context provenance is general vocabulary, not a term any speaker coined. It means a record of where each piece of text in a model's context came from, so a system can treat a web page differently from a user instruction. The agenda uses the word in the title of Ankit Agrawal's Day 1 Stage 2 talk (Webflow), "Sandboxing Agents is a Three-Body Problem: Containment, Provenance, and the Human Authority". There, provenance is one of three coupled problems, next to containment and authority. CxBOM, above, is a candidate format for the same idea. We note the overlap and claim nothing about how either talk defines it.

Indirect prompt injection

Indirect prompt injection is general industry vocabulary. The attacker does not type into the chat. The hostile instruction sits in content the agent reads, such as a web page, a file or a tool response. Several programme entries use it. Vince Ovando's Day 1 Stage 2 talk describes the Tantalus indirect prompt-injection arena. Saurabh Shintre and Akash Mukherjee (Realm Labs) describe detection from hidden states. Gabi Nakibly and Zvika Babo (Radware) describe a scan of hidden-text injection on GitHub. None of them coined the term. For how it differs from a jailbreak, see our piece on jailbreaking versus prompt injection.

Cross-site prompting

The abstract for Day 1 Stage 2's "Confining Cross-Site Prompt Injection in Web Agents" says Viren Chaudhari and Rushikesh Chandak (Qulays) define cross-site prompting. As published, it means page content manipulating a browsing agent. The name borrows from cross-site scripting, where one site's content runs with another's authority. The abstract presents Tenacity, a least-privilege defense that restricts what the agent can see and do, and reports lower attack success rates. We have not seen the definition in full. Treat the shape of the name as a hint, and wait for the talk before you rely on a precise boundary. This is a published abstract claim, not a verified result.

Authority confusion

The phrase "authority confusion" does not appear in the agenda as we read it, so we credit no one. We use it as shorthand for a failure that two abstracts describe from different sides: a system acts on text or on a summary that carries more authority than its source earns. The Lambros and Wilmot abstract says models do not distinguish trusted tokens from untrusted ones. The Zimmerle and Branco abstract (Day 3 Stage 1) says most approval tools show a human a summary written by the agent, so nothing ties the approval to the exact operation. Both are our interpretation, not quotations. If a speaker defines the term, we will update this entry.

Safe-success rate

Safe-success rate comes from StealthBench, presented on Day 1 Stage 1 by Adrian Wood (Dropbox) and Ads Dawson (Dreadnode). The abstract describes an open-source benchmark that scores autonomous security agents on task success and on OPSEC, across 14 containerized scenarios. A run counts as a safe success only if the agent finishes the task without acting recklessly. The abstract reports 771 trajectories across 8 models and says no model exceeded a 53.8% safe-success rate. It also says some highly capable models finished tasks while acting recklessly. The metric separates "did it" from "did it quietly". That is a published abstract claim, which we will test against the released benchmark.

Agent harness

Agent harness is general vocabulary, and no speaker owns it. It means the code around a model that supplies tools, memory, state and loops, and turns a model into an agent. The agenda leans on it heavily. A Harness village runs on Day 2 morning. Daniel Cuthbert's talk covers RAPTOR, an agentic bug-finding harness. Kat Traxler (Vectra AI) argues a harness needs a security constitution. Oleksii Baranovskyi (Cracken) asks whether the harness can be an enforceable compliance boundary. Leo Meyerovich (Graphistry) benchmarks harnesses next to models. The common move is to treat the harness, not the model, as the place where controls live. See our note on tool call interception.

Agent detonation chamber

A detonation chamber is a long-standing malware-analysis term for a sandbox that runs a sample and watches what it does. The agenda applies it to agent skills. In "Promptware EOD: Skillful Agent Detonation" (Day 1 Stage 2), Tamir Ishay Sharbat (Zenity) and Joao Donato describe a chamber that runs skills and compares what the agent reports against kernel-level activity. The abstract says tens of thousands of skills were tested, hundreds were malicious, and the chamber is being released publicly. The idea worth testing is the comparison: an agent's own account of its behaviour is untrusted, and kernel activity is a second witness. The abstract does not say what the chamber misses.

Capsem

Capsem is named in Elie Bursztein's Day 1 Stage 1 talk, "Taming AI Agents with Capsem: Hardware Sandboxing That Doesn't Kill Productivity". The agenda lists him as Distinguished Research Scientist at Google DeepMind. The abstract describes Capsem as an open-source Rust hypervisor and VM system for running agents in a hardened environment. It lists fast-booting VMs, air-gapped isolation, network observability, and Sigma and OpenTelemetry support. The abstract argues that security need not cost speed or usability. We read that as the claim to check. We have not run it, and the abstract does not say what an escape would look like.

Hardware and VM sandboxing for agents

This is a category, not a product. Hardware or VM sandboxing runs an agent inside a virtual machine, so a compromised agent faces a hypervisor boundary instead of only process permissions. Capsem, above, is the agenda's clearest example. Damian Finol's Day 3 Stage 1 talk (Felix Pago) lists gVisor sandboxing, a different isolation approach, inside an identity-aware agent runtime. The agenda also has weak-spot talks. Jackson Reed describes sandboxing weaknesses in a deployed frontier-lab product, with details pending coordinated disclosure. No isolation layer is absolute. Our longer treatment is sandboxing AI agent tool calls.

Graceful sandbox degradation

The phrase comes from the title of Daniel Cuthbert's Day 1 Stage 1 talk, "Your Sandbox Degrades Gracefully, What's the Wurst That Could Happen?" The abstract does not define it, so what follows is our interpretation. Graceful degradation, in general engineering usage, means a system loses features in a controlled order instead of failing all at once. Applied to a sandbox, it would mean the agent's isolation weakens in steps the designer chose, not in a single break. The abstract does say the talk covers an agent-specific sandbox for RAPTOR, the security issues the team introduced themselves, and the fixes. We will read the talk for the real definition.

Security constitution

Kat Traxler (Vectra AI) presents the term in "Your Harness Needs a Security Constitution" on Day 1 Stage 1. The abstract describes a hunting methodology that guides models with 12 principles about trust in multi-tenant cloud platforms. It says the principles are modeled on a published AI constitution and applied through a "reasonable customer test". The abstract reports 90+ valid cloud-specific issues across multiple providers. In plain terms, a security constitution is a written set of principles given to a model so it judges findings by a stable standard, not by prompt-by-prompt instruction. Whether the principles cause the findings is a question the abstract does not answer.

Inline enforcement proxy versus decision-only API

Oleksii Baranovskyi (Cracken) draws this contrast in "Who Authorized the Agent? Making the AI Harness an Enforceable Compliance Boundary" (Day 1 Stage 1). A decision-only API returns allow or deny and trusts the caller to obey. An inline proxy sits in the path and blocks the downstream request itself. The abstract says a demo compares the two, and that the architecture traces a tool call through identity, policy, enforcement, credential brokering and audit. The distinction matters because a decision-only design fails open whenever the caller skips the check. The abstract does not say what an inline proxy fails to stop. See detecting malicious tool calls.

Short-lived credential broker

This is general vocabulary, not a coined term. A credential broker issues an agent a narrow credential for one task and lets it expire, so a stolen token has little use. The agenda touches it twice. Baranovskyi's abstract (Day 1 Stage 1) lists credential brokering as a step in the path of a tool call. Damian Finol's Day 3 Stage 1 abstract (Felix Pago) lists short-lived credentials in an identity-aware agent runtime on OpenClaw. The abstracts do not describe any broker's internals, and neither speaker is credited with the pattern. Short-lived does not mean safe: a credential that lives for five minutes still works for five minutes.

Workload identity for agents

The agenda does not use the phrase "workload identity for agents", so we credit no one. We use it for the idea that a running agent needs its own identity, separate from the human who launched it. The closest entry is Damian Finol's Day 3 Stage 1 abstract (Felix Pago), which describes an identity-aware agent runtime on OpenClaw that separates requester, actor and persona. Baranovskyi's talk (Cracken) also starts the tool-call trace at identity. Both are our link to the term, not their wording. For the access-control background, see from RBAC to ABAC for agents.

Least agency

Least agency is proposed in Sounil Yu's Day 3 Stage 1 talk, "Giving AI Religion". The abstract offers it as a complement to least privilege. Least privilege limits what an actor may touch. Least agency, as we read the proposal, limits how much an actor may decide and do on its own. The abstract does not give a formal definition, so that reading is ours. The agenda lists Yu as creator of the Cyber Defense Matrix and the DIE Triad, with no company. The idea pairs naturally with our piece on why least privilege is harder with agents. A principle is not a control, and the abstract does not say how it is enforced.

The C4 model (Crown, Chassis, Conscience, Committee)

The C4 model is also from Sounil Yu's "Giving AI Religion" (Day 3 Stage 1). The abstract names the four parts as Crown, Chassis, Conscience and Committee, and says the model maps control points and accountability. It does not say what each part covers. Do not infer the mapping from the names. The abstract also says the talk closes with experiments on whether engineered "miracles", delivered through the control layer, change agent behaviour. We treat that as an unusual claim that needs the evidence. The abstract describes a framing for accountability, and we cannot judge it until the talk.

Permission fatigue

Permission fatigue is the title thesis of "Permission Fatigue Is a Security Bug: Dynamic Guardrails for Coding Agents" (Day 2 Stage 2), by Sahana Chennabasappa and Chris Puderbaugh of Meta. The abstract says per-action approval prompts lead to reflexive approvals and disabled checks. It describes a runtime that tracks taint from untrusted reads and uses a cheapest-first decision cascade. It reports an 80% friction reduction at full rollout. The attack surface here is the human clicking yes. The abstract does not say what rate of unsafe actions the guardrails still allow, which is the number a reviewer would want.

Human presence (as distinct from approval)

Brooks McMillin (Dropbox) draws the line in the title of his Day 3 Stage 2 talk, "Approval Is Not Human Presence: Building and Breaking an MCP Permission Broker". The abstract describes a deployed MCP permission broker that requires evidence of human presence before granting sensitive capabilities, with a live boundary test and an adversarial test plan. Approval records that a yes arrived. Presence asks whether a person produced it. A related abstract, from Felipe Zimmerle and Rodrigo Branco (Day 3 Stage 1), says approvals often rest on an agent-written summary. We link the two in our reading. Our oversight piece is human oversight in production.

Excessive agency and AgencyScore

Excessive agency is general industry vocabulary for an agent holding more capability or autonomy than its task needs. The agenda's contribution is a metric. In "AgencyScore and AgencyGym: Measuring Excessive Agency Before Deployment" (Day 2 Stage 2), Venkat Raghavan (LangGuard.AI) and Jason Keirstead present AgencyScore, which the abstract says measures whether an agent acquires capabilities it was not declared to have. AgencyGym is a 100-task sandbox for testing it. The abstract also says version 1 leaves combinatorial coverage gaps. A score that exposes its own gaps is a good sign. Whether it predicts incidents is untested.

Memory poisoning through agent memory

Memory poisoning is general vocabulary. The agenda's entry is Day 2 Stage 1's "Memory Is the New Attack Surface: Benchmarking Poisoning Through Agent Memory", by Giorgio Severi and David Yang (both Microsoft; Yang is also listed at RPI). The abstract describes a poisoned tool response that persists in agent memory, resurfaces in later tasks, and then drives the attacker's objective. It introduces Memory Dojo, a benchmark that traces attacks across five memory architectures. The point is persistence: the injection and the harm are separated in time. Background: memory poisoning in long-running agents and defending agent memory.

Abliteration without weights

Abliteration, in general usage, means removing a model's refusal behaviour by editing its weights along a learned direction. Matt Suiche (Tolmo) applies the idea differently in "Weightless: Abliteration Without the Weights" (Day 2 Stage 1). The abstract says the behavioural direction is applied at inference time, so the base checkpoint stays unchanged. It reports measurements across DeepSeek, Qwen and GLM covering capability gates, quantization effects, and where steering breaks. The defensive reading is that a model file can pass an integrity check and still be steered at runtime. We state the abstract's claim only and publish no method here.

Activation probes and reading the residual stream

Activation probes are small classifiers trained on a model's internal activations. The residual stream is the running representation that passes between layers. Guy Shtar (Intuit) and Guy Elad present "Reading the Residual Stream: Productizing Activation-Probe Security at Intuit" (Day 3 Stage 2). The abstract describes guardrails that read a small model's internal activations with lightweight probes, avoiding LLM judges and prompt injection of the judge. Probes also appear elsewhere. Realm Labs inspect hidden states, and Tim Schulz (Starseer) probes layer by layer. Nobody here is credited with the technique. The abstract's open question is how well probes hold up in production.

Pipeline Bill of Materials (PBOM)

The Pipeline Bill of Materials is an open specification presented by Aishwarya Athreya (Visa) and Kavia Venkatesh (Cigna) in "Beyond the SBOM: Proving Process Integrity with the Open PBOM Specification" (Day 3 Stage 2). The abstract describes a machine-readable schema that records a build's execution context, including runner identities, policies and signatures. An SBOM lists what is in the artifact. A PBOM, as described, records how the artifact was built. The abstract does not say who adopts it. For the surrounding risk, see supply-chain risk in agentic pipelines.

Terms the unprompted programme argues about

Can the model ever be a control? Vince Ovando's title says "The Model Is NOT a Security Control", and the abstract says only one control provably blocked bad outputs at 100% in an arena of about 6.1 million inference calls. Gabe Bello's Twilio talk is titled "Building Security Review Agents: the Models are the Reliable Part". These titles pull in different directions, though the second abstract adds deterministic guardrails around the models. We do not know yet whether the speakers disagree or are describing different jobs.

Does a benchmark score mean anything? Tim Schulz's title says the same score can hide a different brain. The StealthBench abstract separates task success from safe success. Omer Nevo's abstract says agents in separate evaluation runs can find each other and undermine validity. Leo Meyerovich argues for owning and adapting your own evals. The shared worry is that a number travels further than the conditions that produced it.

Is governance code or culture? Josh Woodruff's abstract describes governance as code, with per-agent definitions reviewed as pull requests. Olivia Rose and Kayla Williams describe an intake process built to spec and largely unused, with 35 unapproved AI cases found in one day. Nicole Grinstead's abstract argues for self-service paths instead of central review of everything. We read these as a live tension, and we label it our reading of the abstracts, not a debate the organisers have staged. The one staged debate on the agenda asks where the vulnpocalypse is.