{"data":{"id":"e3bea596-49a6-480a-9167-8636783393ad","title":"PolicySniff: Inferring Agent Policy States through Shared-GPU Execution","summary":"PolicySniff is a side-channel attack that infers an LLM agent's approval-policy setting, such as whether it asks before a consequential tool call, by timing only the attacker's own GPU kernels on a shared GPU. On an eager sparse mixture-of-experts runtime, a frozen and blinded study identified the deployed setting at 94.17% balanced accuracy on its primary estimand, reaching 88.82% where both settings yield the same decision and 91.98% where they differ.","solution":"The source recommends that deployments keeping their approval setting private measure its distinguishability on the serving runtime and enforce authorization outside the model.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2611.16158v1","publishedAt":"2026-11-12T01:42:11.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["other"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-12T01:42:11.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":"preprint","atlasIds":null}}