---
title: 'In the News: October 26, 2026 (Extra 3)'
description: "Meta's LogAct paper logs every agent action for voters to approve first: 1.4% attack success on AgentDojo, at a measured cost in utility."
canonical_url: 'https://darkfactory.dev/news/2026-10-26-extra-3'
markdown_url: 'https://darkfactory.dev/news/2026-10-26-extra-3.md'
collection: news
date_published: '2026-10-26T23:20:00-04:00'
date_modified: '2026-10-26T23:20:00-04:00'
---

# In the News: October 26, 2026 (Extra 3)


One item this cycle: a Meta paper that treats an agent as a log of intended actions, each of which must be approved before it runs, with numbers on what that blocks and what it costs.

## 1. Meta's LogAct records every agent action before it runs and lets separate voters veto it

**[LogAct: Enabling Agentic Reliability via Shared Logs](https://arxiv.org/abs/2604.07988)** · Mahesh Balakrishnan and nine co-authors, Meta · arXiv, April 9, 2026

The paper splits an agent into parts that share one durable, append-only log. A driver proposes an action, voters approve or block it, a decider counts the votes, and an executor runs the approved code. An action is written to the log before it executes, so the same log doubles as a crash-recovery record and an audit trail. The authors built it three ways, including a minimal version on Claude Code's pre-execution hooks. They rate that version's introspection as limited, and note it still runs as an imperative loop rather than a state machine. Murat Demirbas's [notes from HPTS 2026](https://muratbuffalo.blogspot.com/2026/10/hpts-2026-day-1.html) list Balakrishnan presenting the work there.

The authors report these results, all from their own experiments:

- On the AgentDojo prompt-injection benchmark, a 2024-era model with no defense had a 48.2% attack success rate and 81.4% benign utility. A rule-based voter cut attack success to 1.4%, but utility fell to 49.5%. Adding a second, LLM-based voter that can override the first restored utility to 78.4% with attack success still at 1.4%. Average task time went from 6.7 seconds to 12.2 seconds.
- The 1.4% that still succeeded were attacks that needed no action on the environment, so voters had nothing to block.
- In a checksum job over 2,000 folders, a recovery agent read the log of a stalled run, found a slow file-enumeration call, and finished the remaining folders in 0.36 seconds, which the authors call 290X faster.
- In a six-agent swarm adding type annotations to a Python codebase, an extra supervisor agent reading each agent's log produced 17% more work with 41% fewer tokens.

The limits are the authors' to state, and they do. The rule-based voter's rules were written by having an offline LLM study the same model's runs on the same benchmark, so the 1.4% is a tuned result. Each demonstration is a single benchmark or a single task. The paper says it cannot give a binary guarantee that an LLM voter will catch an unsafe action, and that an executor able to rewrite its own voters defeats the design unless the two run on isolated infrastructure. Models and the internal harness appear only under placeholder names.

**Why it matters:** If your agents act on anything you cannot roll back with git, the design idea is more portable than the system: write the intended action down before executing it, and run whatever approves it where the code-writing process cannot reach. The utility numbers show the price of a rules-only gate, a drop from 81.4% to 49.5% benign task success in this test, and what a second reviewer recovered.