ActGuard audits the planned action instead of filtering the tool output.

A different shape of indirect prompt injection defense: predict the likely tool usage at each step, build a local tool prior, flag the planned action when it deviates from what's locally reasonable (arXiv 2609.14987). Reported attack success rates comparable to state-of-the-art defenses with task utility near the no-attack baseline, and an open-source implementation. The framing holds up even apart from the numbers, since content-level filtering keeps losing to obfuscation while action-level auditing sits closer to what you want to prevent.