Security awareness in LLM agents: the NDAI zone case

TL;DR

This paper investigates how different large language models assess security evidence in NDAI zones, revealing they detect danger but struggle to verify safety, which is crucial for privacy-preserving negotiations.

Contribution

It provides an empirical analysis of LLMs' responses to security evidence in NDAI-style negotiations, highlighting their limitations in safety verification.

Findings

Failing attestation suppresses disclosure across models

Passing attestation leads to heterogeneous responses

Current LLMs reliably detect danger but not safety

Abstract

NDAI zones let inventor and investor agents negotiate inside a Trusted Execution Environment (TEE) where any disclosed information is deleted if no deal is reached. This makes full IP disclosure the rational strategy for the inventor's agent. Leveraging this infrastructure, however, requires agents to distinguish a secure environment from an insecure one, a capability LLM agents lack natively, since they can rely only on evidence passed through the context window to form awareness of their execution environment. We ask: How do different LLM models weight various forms of evidence when forming awareness of the security of their execution environment? Using an NDAI-style negotiation task across 10 language models and various evidence scenarios, we find a clear asymmetry: a failing attestation universally suppresses disclosure across all models, whereas a passing attestation produces highly heterogeneous responses: some models increase disclosure, others are unaffected, and a few paradoxically reduce it. This reveals that current LLM models can reliably detect danger signals but cannot reliably verify safety, the very capability required for privacy-preserving agentic protocols such as NDAI zones. Bridging this gap, possibly through interpretability analysis, targeted fine-tuning, or improved evidence architectures, remains the central open challenge for deploying agents that calibrate information sharing to actual evidence quality.