Model-Checking an Agent's Plan Before Any Tool Runs Rejects Unsafe Plans Without Spending a Single Tool Call

arXiv 2609.18674·medium signalXBlueskyLinkedInCopy link

arXiv 2609.18674 (16 Sep 2026) extends CaMeL, the existing prompt-injection defense for tool-using agents, with a static verification layer. CaMeLoT translates a generated plan into a finite-state transition system labeled with tool calls, provenance and taint, then checks it against CTL temporal policies using the nuXmv model checker before execution begins, so unsafe plans are rejected with no LLM or tool calls spent and no sandbox teardown or state unwinding. When verification fails the model checker returns a counterexample the agent can use to repair its plan, and the evaluation covers policies derived from AgentDojo, SOC workflows and prompt-extraction experiments.