Training an anomaly detector only on benign agent workflows caught zero-day failures at sub-1% false positives

arXiv 2609.06835·medium signalXBlueskyLinkedInCopy link

Skynet argues that step-level and prompt-level checks miss the failures that only appear when an execution is viewed whole, since a single corrupted step (an injected prompt, a flawed plan) propagates across many downstream agents and tool calls. It converts observed multi-agent execution into directed workflow graphs and jointly models the semantic execution context and the structural organization of inter-agent delegation, tool invocation and data-flow dependencies, scoring against learned benign behavior. Because training never sees attacks, anything violating benign regularities surfaces as off-manifold geometry under one decision rule, and across three public agentic safety and failure benchmarks it held high recall with a sub-1% false positive rate at per-workflow and per-step latencies suitable for online monitoring.