AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems
2026-08-24 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors introduce AgentFlow, a system designed to control how sensitive data moves within networks of AI agents that perform multiple steps involving untrusted content and tools. Instead of focusing on single actions, their approach tracks data flows across steps to prevent leaks. They created a special policy language and a runtime monitor to enforce rules about who can access or delegate data securely. In tests on various agent tasks, AgentFlow stopped all detected data leaks without significantly reducing performance. The authors note these findings are early and limited to the behaviors and benchmarks they studied.
LLM agentsdata flow controlpolicy languageruntime monitoringtaint trackingSMT verificationdelegation boundariestask-scoped capabilitiessensitive datasecurity enforcement
Authors
Basavesh Ammanaghatta Shivakumar, Swarn Priya, Peng Gao
Abstract
LLM agents increasingly read untrusted content, invoke external tools, access private data, and delegate work to other agents. Harm often arises not from a single unsafe action but from the flow of sensitive data across a sequence of otherwise plausible steps. We present AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems. Policies are defined over labeled runtime edges and constrain which tools may receive sensitive fields, which sinks may receive released data, and what authority may cross delegation boundaries. The language supports flow and path rules, task-scoped capabilities, controlled release, and stateful taint semantics. A runtime reference monitor mediates agent actions, and a bounded SMT-based verifier checks safety properties for a structured policy fragment. We evaluate AgentFlow on multiple agent benchmarks. In our prototype, seven safety properties verify in under 0.5 seconds each, and the verifier catches all seeded unsafe policy variants in our study. On 949 AgentDojo injected cases across four suites, AgentFlow reduces confirmed compromise from 33.0\% to 0.0\% while improving aggregate utility from 46.7\% to 63.3\%. On a 200-case AgentDyn Dailylife benchmark, it reduces confirmed compromise from 73.5\% to 0.0\% while preserving near-baseline utility (44.5\% to 43.5\%). Breadth checks across ASB, InjecAgent, BIPIA, AgentHarm, and MCPTox replays suggest that the configured policies block the benchmark-specified policy-visible attacker flows; in ASB's direct-prompt-injection harness, attack success is 0/1{,}200. These results are preliminary and scoped to the modeled policy-visible agent behaviors and evaluated benchmarks.