LATIDIA · Ciberseguridad

¿Quién está detrás del arnés? LLM de huellas dactilares a través del comportamiento agénico

arXiv: 2609.28559v1Announce Type: new Resumen: Los LLM operan cada vez más a través de arneses de agentes de codificación que inspeccionan repositorios, invocan herramientas y modifican archivos. Sustituir el modelo detrás de dicho agente puede por lo tanto

La noticia

arXiv:2609.28559v1 Announce Type: new Abstract: LLMs increasingly operate through coding-agent harnesses that inspect repositories, invoke tools, and modify files. Substituting the model behind such an agent can therefore change security-relevant decisions, including whether it verifies changes or recovers safely from failures. Existing LLM fingerprints largely infer identity from direct text or token distributions. In coding agents, these signals are mediated by system instructions, controller logic, tools, and execution feedback, limiting their transfer. We present LIDAR (LLM Identification from Decisions and Actions at Runtime), an active black-box fingerprinting method for coding-agent execution. Three coding probe pairs expose post-edit verification, transient-failure recovery, and specification--test conflict resolution under controlled changes. LIDAR represents the