Agentic large language model systems that autonomously invoke tools, maintain persistent memory, and execute multi-step plans are increasingly deployed in public-facing domains, including government services, healthcare triage, and financial advising. We ask whether the frameworks used to build these systems provide architectural-level structural safety guarantees. Applying six containment principles derived from a compositional model of agentic architectures, we audit three dominant frameworks (LangChain, AutoGPT, and OpenAI Agents SDK) and find no native compliance in any of them. Memory integrity, a defense against one of the most prevalent vulnerability classes, is not observed in any of the three evaluated frameworks. We validate these findings empirically: in a simulated government benefits agent built on LangChain, a single memory-poisoning write induces persistent targeted corruption across all tested seeds and backends, increasing the wrongful denial rate for targeted applicants to 88.9%. Under a complex five-factor policy, the same attack preserves aggregate accuracy while increasing targeted wrongful denials by 3.5x, rendering the corruption difficult to detect through standard monitoring. We then introduce two lightweight containment mechanisms: a memory integrity validator and a policy gate, which eliminate both attack vectors with sub-millisecond overhead (<0.2ms per call). We conclude that the current agentic framework ecosystem may not yet meet secure-by-default expectations for public-facing deployments and outline priority architectural interventions to enable trustworthy deployment in high-stakes, socially impactful applications.

翻译：摘要：自主调用工具、维持持久记忆并执行多步计划的自主大语言模型系统日益部署于面向公众的领域，包括政府服务、医疗分诊与金融咨询。我们探究构建此类系统的框架是否提供架构层面的结构性安全保障。通过应用从自主架构构成模型推导出的六项包容性原则，我们对三种主流框架（LangChain、AutoGPT与OpenAI Agents SDK）进行审计，发现三者均未原生满足任何一项原则。记忆完整性——防御最常见漏洞类别的手段——在全部三种被评估框架中均未得到保障。我们通过实证验证了上述发现：基于LangChain构建的模拟政府福利代理中，单次记忆投毒写入即引致持久定向破坏，且跨越所有测试种子与后端，针对特定申请人的错误拒绝率升至88.9%。在复杂五因素政策下，同一攻击在保持整体准确率的同时，使定向错误拒绝率提升3.5倍，导致破坏难以通过标准监控察觉。我们随后引入两种轻量级包容性机制：记忆完整性验证器与策略门控，两者以亚毫秒开销（每次调用<0.2毫秒）消除全部攻击向量。结论认为，当前自主框架生态系统可能尚未满足面向公众部署的安全默认预期，并概述了优先架构干预措施，以支撑高风险、高社会影响应用中的可信部署。