Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-25 · high
It tracks where data moves through an agent instead of judging one action at a time, and task success rose to 63.3% from 46.7%.
Why now: AgentFlow posted to arXiv in August 2026, testing against three separate agent-safety benchmarks that already stand in for how deployed agents get attacked with prompt injection.
A new policy language pushed confirmed agent compromise to zero, down from 33%, according to the AgentFlow paper.
That risk applies to anyone running an agent with access to files, email, or code. On AgentDojo's 949 test cases, agents defended by current methods still got compromised 33% of the time.
Most agent defenses judge each action on its own, asking whether one file read or one API call looks dangerous. AgentFlow tracks where data is allowed to move through the whole system instead. It combines flow and path rules, capabilities scoped to a single task, controlled release points, and taint tracking that persists across steps. A runtime monitor enforces the rules, and a separate verifier checks seven safety properties against them with SMT solving, each in under half a second.
On AgentDojo, that combination cut compromise to 0.0% and lifted task success to 63.3%, up from 46.7%. AgentDyn Dailylife's compromise rate dropped from 73.5% to 0.0% with utility essentially flat, and none of ASB's 1,200 direct prompt injection attempts got through.
The paper doesn't say how the policies get written for a new agent. It also doesn't say how much engineering work that takes before an app can plug the system in. Checking seven properties in under half a second only helps if someone declared the right properties to check.
Each link below shares sources, entities, or timing with this story.
ToolHazard supports AgentDojo / Shared entity: AgentDojo / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (ToolHazard supports AgentDojo); both cover AgentDojo; reported by the same outlet (arxiv.org).
Shared entity: AgentDojo / Same source domain / Shared topic / Earlier coverage / Tension
Both cover AgentDojo; reported by the same outlet (arxiv.org); overlapping topics (action, agent, agentdojo, utility).
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover AgentDojo, ASB; reported by the same outlet (arxiv.org); overlapping topics (agent, agentdojo).
Shared entity: AgentDojo / Same source domain / Shared topic / Earlier coverage / Tension
Both cover AgentDojo; reported by the same outlet (arxiv.org); overlapping topics (agent, agentdojo).
Both cover AgentDojo; reported by the same outlet (arxiv.org); overlapping topics (agent, agentdojo).
PromptArmor benchmarked against AgentDojo / Same source domain / Shared topic
Linked by a graph relationship (PromptArmor benchmarked against AgentDojo); reported by the same outlet (arxiv.org); overlapping topics (agent, agentdojo).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (action, agent, rather); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (agent, capability); pushes against this story (but).