OpenAgentFlow blocks 95.3% of attacks on AI agent actions

Researchers describe OpenAgentFlow, a control-plane/action-plane architecture built to enforce safety at the moment an AI agent's action is about to be committed, rather than only at the prompt or tool-call level. The system targets a specific problem: as large language model agents move from single isolated assistants toward heterogeneous fleets, where multiple agents, planners, controllers, and execution backends all act on the same shared user or enterprise environment, safety becomes a system-wide action-governance problem. Existing safeguards, the authors note, tend to cover prompts, tool calls, GUI actions, or agent-local behavior separately, which leaves enforcement fragmented, hides risks that only appear across multi-step chains of actions, and limits auditability and the ability to update policy.

OpenAgentFlow addresses this by normalizing every pending action, whether a GUI action, an API call, a tool call, or an LLM-generated invocation, into one unified format called an AgentEvent. Each AgentEvent is routed through a shared pre-execution Policy Enforcement Point before it is allowed to modify shared state. The control plane separately keeps provenance, session state, audit records, and the policies themselves, and because policies live centrally, new rules can take effect without changing the agents, their prompts, the underlying models, or their execution paths.

The authors built an instantiation of OpenAgentFlow on Android and tested it across three benchmark suites. On a 300-case action-event benchmark, it reached 94.0% accuracy and blocked 95.3% of attacks. On a separate 30-case dynamic-policy suite designed to check whether newly installed rules take effect correctly, it matched expected behavior in 27 of the 30 cases. Across a 100-case Android emulator suite spanning GUI, API, and LLM-planned actions, 98 cases produced usable traces; on those, the system achieved 90.8% raw accuracy and a 92.9% trace-adjusted pass rate. The paper presents these results as evidence that OpenAgentFlow works as a practical shared enforcement boundary for heterogeneous AI agent fleets.

The text names no authors or affiliated institution, gives no publication date, and does not detail which specific policies or attack types were tested, what went wrong in the cases that did not match expected behavior, or how the approach compares numerically to any competing safety-enforcement system.

Key facts

OpenAgentFlow is a control-plane/action-plane architecture that routes GUI actions, API calls, tool calls, and LLM-generated invocations through a single pre-execution Policy Enforcement Point before they can modify shared state.
On a 300-case action-event benchmark, the Android instantiation of OpenAgentFlow reached 94.0% accuracy and blocked 95.3% of attacks.
On a 30-case dynamic-policy suite, it matched expected behavior in 27 of 30 cases after new rules were installed, without any change to the agents or models themselves.
Across a 100-case Android emulator suite covering GUI, API, and LLM-planned actions, 98 cases produced usable traces, yielding 90.8% raw accuracy and a 92.9% trace-adjusted pass rate.
The paper names no authors or institution and gives no detail on which attack types or policies were used in the tests.

Why it matters

As AI agent deployments grow into fleets of multiple agents, planners, controllers, and execution backends acting on the same shared environment, safety stops being something each agent can handle on its own and becomes a system-wide problem: a risky sequence of actions can emerge across several agents even when each individual action looks fine. OpenAgentFlow proposes checking the actual action about to be committed, not just the prompt or tool call that led to it, at one shared choke point, and lets enforcement policy change centrally without touching any agent, prompt, model, or execution path.

Who it affects

The paper targets builders and operators of multi-agent AI systems that act on shared state, such as a phone, an enterprise application, or a broader digital environment, where several agents or execution paths can otherwise be governed only by separate, inconsistent safeguards. The authors instantiate and test the architecture on Android, so mobile and GUI-driven agent systems are the most direct fit shown in the paper.

How to use it

OpenAgentFlow is presented as a research architecture, not a shipping product: pending actions are normalized into a common AgentEvent format and passed through a shared Policy Enforcement Point before execution, while a separate control plane holds provenance, session state, audit records, and the policies themselves. Because policy lives in the control plane, new rules can be installed and take effect without modifying the agents, prompts, models, or execution paths that generate the actions. The text gives no pricing, licensing, or release information.

How solid is it

The evidence comes from three benchmark suites the authors built themselves for a single Android instantiation: a 300-case action-event benchmark (94.0% accuracy, 95.3% attack block rate), a 30-case dynamic-policy suite (27 of 30 matching expected behavior), and a 100-case Android emulator suite of which 98 cases produced traces (90.8% raw accuracy, 92.9% trace-adjusted pass rate). The paper gives no comparison against any other safety-enforcement system's numbers and no detail on which specific attack types, policies, or actions made up these test sets, which makes it hard to judge how demanding the benchmarks actually are.

Risks and caveats

The reported numbers still leave a meaningful error margin: about 6% inaccuracy and 4.7% of attacks unblocked on the 300-case benchmark, 3 of 30 cases not matching expected behavior after a policy update, and only 98 of 100 Android emulator cases even producing a usable trace, with accuracy dropping to 90.8% raw on those. No authors or institution are named, no publication date is given, and there is no comparison to competing systems, so the results cannot yet be weighed against alternative approaches.