AI agent safety starts with execution, not with the prompt

The main risk with an autonomous agent is not that it answers badly but that it can call a tool, change files or persist state with no intelligible control. So security here has to be built around the execution environment rather than around a lucky prompt.

That is exactly what Agentao proposes — a locally oriented runtime for LLM agents. The model generates a proposed action but does not execute it directly: the decision passes through the host contract, the runtime kernel and a tool system with permissions.

An important detail is that the agent's actions become explicit objects that can be inspected and taken apart: state, protocol boundaries, tool access and execution traces. Around this runtime there is provision for memory, replay, plugins, skills, subagents and protocol integrations.

The practical sense of the approach is fairly down to earth. If an agent works with local files, external services and persistent memory, it needs more than instructions to "be careful" — it needs technical boundaries: what is permitted, who permitted it and what exactly happened. That makes the system more governable and auditable before we even start discussing model quality.

But Agentao promises no magic protection. The authors state outright that there are no formal safety guarantees. The work describes an architecture and a governance model; it does not prove that prompt injection, tool poisoning or side effects have been eliminated. The project's code is published on GitHub, so the idea can be studied and checked independently.

Are you ready to give an agent the right to change local files if every action can be permitted in advance and reconstructed afterwards from a log? Source: cs.AI updates on arXiv.org