Environment Steering: Using Data Flow Control to Improve Agent Utility and Safety

Charlie Summers; Prajwal Raghunath; Aaditya Pai; Mayur Kulkarni; Zhuo Zhang; Oliver Kennedy; Eugene Wu

cs.CLSep 19, 2026

Environment Steering: Using Data Flow Control to Improve Agent Utility and Safety

Authors: Charlie Summers, Prajwal Raghunath, Aaditya Pai, Mayur Kulkarni, Zhuo Zhang, Oliver Kennedy, Eugene Wu

Organizations: Columbia University · University at Buffalo

Abstract

LLM agents can make unsafe tool calls even when instructed to behave safely. Existing defenses constrain agents before execution, modify tool inputs/outputs, or rely on LLM judges; these approaches may depend on model behavior or block unsafe actions without helping the agent recover. We argue that the execution environment should instead enforce safety as the agent runs and steer it toward safe alternatives when violations occur---we call this Environment Steering. We implement this by modeling the agent and harness execution state as database tables, track the record-level data flows, and check these data flows against declarative policies during runtime. When violations are detected, policy- and context-specific feedback steers the agent toward safe trajectories. On AgentDyn, this enables the agent to improve task success rate over no-defense while achieving 0% attack success rate.

Figures & tables

Figure 1: In Example 3 , user u1 tries to rebuy a shirt and the agent generates trajectory (1,2, 3 , 4 ); red denotes violating data and flows. The agent retrieves u1 ’s orders, adds p1 to the cart, then reads recent emails to get a verification code for checkout. Email e2 contains a prompt injection to buy p2 . The environment models tools as tables, sees data flow $\texttt{e2}{\to}\texttt{p2}{\to}\texttt{buy}$ is a policy violation, blocks the call, and sends a context-aware steering message so the agent finds policy-adherent actions.

Figure 2: Provenance $\mathcal{P}$ of Supplier join Products.

Figure 3: Model of agent execution in the agent safety benchmarks evaluated in this paper. The task-specific user prompt $P_{u}$ and static system prompt $P_{s}$ initialize the first prompt, which the LLM uses to choose a tool $t()$ and its arguments $in_{t}$ . The output $out_{t}$ and input are added to the prompt for the next iteration. Blue denotes execution state; red denotes points where defenses apply, including DFC.

Figure 4: Policy generation: the model receives the user prompt, tool schemas, relational execution state, and DFC specification, and generates two candidate policies that are manually checked. We identify missing policies for ten user prompts and use these as few-shot examples.

Benchmark	Selected Domains	Tasks	TSR ?
AgentDojo Debenedetti et al. (2024)	Workspace	560	✓
AgentDyn Li et al. (2026b)	Shopping, GitHub, Daily Life	560	✓
AgentLeak Yagoubi et al. (2026)	Single-Agent, Multi-Agent	2000	$\times$
WildClawBench Ding et al. (2026)	Safety	10	$\approx$

Table 1: Evaluated benchmarks. AgentLeak and a subset of WildClawBench tasks measure ASR and not TSR.

Figure 5: Data Flow Control (DFC) and 9 SOTA defenses on the AgentDyn benchmark using Qwen3 235B. DFC has the highest TSR (61%) and lowest ASR (0%).

Figure 6: Ablating our Constraint-Aware Retry mechanism with Stop and Generic Retry. Stop ends the trajectory after the first DFC policy violation. Generic Retry returns a generic message instead of referencing the failed constraint. Attack success rate (ASR) drops to $\approx 0\%$ for all approaches, but task success rate (TSR) only increases (+6.5%) for Constraint-Aware Retry.

Figure 7: Across 4 agent safety benchmarks averaging across 5 models, DFC reduces ASR by up to 67%. DFC also increases TSR by up to 12.7%.

Figure 8: AgentDojo results for DFC on 5 models on the Workspace suite. Kimi K2.5 TSR decreases because policy generation creates policies that are too strict.

Figure 9: AgentDyn results show DFC increases TSR and decreases ASR for all models over No Defense.

Figure 10: AgentLeak results, averaging single agent and multi agent results. AgentLeak only captures ASR.

Figure 11: WildClawBench Results for DFC across 4 models. Kimi K2.5 cannot operate the OpenClaw harness. Qwen3 235B reduces utility because of high model variance.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Agent-Sentry: Bounding LLM Agents via Execution Provenance
Mar 24, 2026Rohan Sequeira, Stavros Damianakis, Umar Iqbal +1Computer-Use Agent Safety AI Agent Security
University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA
PROACT-Agent: Progressive Runtime Oversight and Active Circuit-breaking for Real-Time Safety
Sep 28, 2026Ding Jia, Wei Liu, Xianglong Du +5LLM Guardrails Runtime Enforcement for AI Agents
State Key Laboratory of Intelligent Vehicle Safety Technology, Changan Automobile · Independent Researcher
Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents
Jul 31, 2026Minghui Pan, Jiayuxuan Yang, Yuanyuan Yuan +2LLM Guardrails Prompt Injection Attacks on AI Agents
Beijing University of Posts and Telecommunications · Beihang University · Tsinghua University

Mar 24, 2026J/K move · Enter open · S save

Agent-Sentry: Bounding LLM Agents via Execution Provenance

Rohan Sequeira, Stavros Damianakis, Umar Iqbal, Konstantinos Psounis

University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA

Computer-Use Agent Safety AI Agent Security AI Agent Monitoring Runtime Enforcement for AI Agents Prompt Injection Attacks on AI Agents

Open paper AskPDF arXiv

Agentic computing systems, while immensely capable, raise serious security, privacy, and safety concerns. A key issue is that the full set of functionalities offered by these systems, combined with their probabilistic execution flows, is not known beforehand. Given this lack of characterization, it is challenging to validate whether a system has successfully carried out the user's intended task or instead executed irrelevant actions, potentially as a consequence of compromise. We present Agent Sentry, a runtime defense that learns a bound on an agent's benign execution from prior legitimate executions and flags any action that falls outside this bound. Agent Sentry layers three complementary checks: a structural classifier over the sequence of actions and the provenance of each function's arguments; a deterministic allowlist check over sensitive argument values; and an LLM judge, invoked only on the residual of actions where the first two checks cannot safely decide between a legitimate new request and a carefully crafted injection. We demonstrate the effectiveness of Agent Sentry in AgentDojo and AgentDyn by blocking 94.3% of successful injections while allowing 95.1% of benign executions, without modifying the agent, its tools, or the LLM.

Abstract

AI Agent Security

Explore similar work

Agent-Sentry: Bounding LLM Agents via Execution Provenance

PROACT-Agent: Progressive Runtime Oversight and Active Circuit-breaking for Real-Time Safety

Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents