AgentFlow: Flow-Centric Policy Enforcement for LLM Agent Data Flows (Defensive Research)
First seen Aug 25, 2026 · Updated Aug 25, 2026
This is not a vulnerability disclosure but a research paper describing AgentFlow, a defensive framework that enforces data-flow policies across LLM agent tool calls and delegation boundaries to prevent prompt-injection-driven data exfiltration and unsafe cross-agent authority propagation. The work reports strong reductions in confirmed compromise rates across several established agent security benchmarks (AgentDojo, AgentDyn, ASB, InjecAgent, BIPIA, AgentHarm, MCPTox). Severity is rated low because the raw data describes a proposed mitigation, not an active threat, exploit, or newly discovered weakness.
Technical Analysis
AgentFlow introduces a flow-centric policy language and runtime reference monitor that labels data as it moves across agent execution edges (tool calls, sinks, delegation boundaries) and applies taint-tracking semantics to restrict which tools/sinks may receive sensitive fields. It uses a bounded SMT-based verifier to formally check policy safety properties before deployment, and enforces controlled release and task-scoped capabilities at runtime to block flows that would otherwise let untrusted content (e.g., injected instructions in tool outputs) exfiltrate data or escalate authority across agent boundaries. The system was evaluated against known adversarial benchmarks simulating prompt injection and tool misuse (AgentDojo, ASB, InjecAgent, BIPIA, AgentHarm, MCPTox), reducing measured compromise rates to near zero in the tested harnesses while retaining task utility. This describes a mitigation architecture rather than an attack technique; it implicitly documents the underlying threat classes (prompt injection causing tainted data flow to unauthorized tools/sinks, and improper authority delegation between agents) that motivated the research.
Affected Systems
AgentDojo, AgentDyn, ASB, InjecAgent, BIPIA, AgentHarm, MCPTox (benchmarks referenced, not vulnerable frameworks); protocols: MCP
Detection Signatures
- N/A - this is a defensive research paper, not an attack; no IOCs or payloads apply.
- For teams evaluating similar mitigations, monitor for: unlabeled/unconstrained data flow from untrusted tool outputs directly into sensitive sinks (email, file write, external API) without intermediate policy checks; agent delegation calls that pass full authority/context to sub-agents without capability scoping.
Remediation Steps
- 1
Evaluate flow-centric policy frameworks
Consider adopting data-flow/taint-tracking policy enforcement (as proposed by AgentFlow) at the agent runtime layer to constrain which tools and sinks can receive sensitive or untrusted-derived data.
- 2
Adopt task-scoped capability delegation
When agents delegate to sub-agents or tools, scope the authority/capabilities granted to the minimum needed for the task rather than passing full context or credentials.
- 3
Benchmark against known adversarial suites
Test agent deployments against established red-team benchmarks (AgentDojo, ASB, InjecAgent, BIPIA, AgentHarm, MCPTox) to measure susceptibility to prompt-injection-driven data exfiltration before production rollout.
- 4
Apply formal verification where feasible
For high-assurance deployments, use bounded verification (e.g., SMT-based checks) on policy fragments to catch unsafe policy configurations prior to runtime enforcement.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.