AgentFlow cuts a 33% compromise rate to zero

A new policy language pushed confirmed agent compromise to zero, down from 33%, according to the AgentFlow paper.

That risk applies to anyone running an agent with access to files, email, or code. On AgentDojo's 949 test cases, agents defended by current methods still got compromised 33% of the time.

Most agent defenses judge each action on its own, asking whether one file read or one API call looks dangerous. AgentFlow tracks where data is allowed to move through the whole system instead. It combines flow and path rules, capabilities scoped to a single task, controlled release points, and taint tracking that persists across steps. A runtime monitor enforces the rules, and a separate verifier checks seven safety properties against them with SMT solving, each in under half a second.

On AgentDojo, that combination cut compromise to 0.0% and lifted task success to 63.3%, up from 46.7%. AgentDyn Dailylife's compromise rate dropped from 73.5% to 0.0% with utility essentially flat, and none of ASB's 1,200 direct prompt injection attempts got through.

The paper doesn't say how the policies get written for a new agent. It also doesn't say how much engineering work that takes before an app can plug the system in. Checking seven properties in under half a second only helps if someone declared the right properties to check.