Engineering Robustness into Personal Agents with the AI Workflow Store
Not on the map. Why?
Abstract (arXiv)
The dominant paradigm for AI agents is an "on-the-fly" loop in which agents synthesize plans and execute actions within seconds or minutes in response to user prompts. We argue that this paradigm short-circuits disciplined software engineering (SE) processes -- iterative design, rigorous testing, adversarial evaluation, staged deployment, and more -- that have delivered the (relatively) reliable and secure systems we use today. By focusing on rapid, real-time synthesis, are AI agents effectively delivering users improvised prototypes rather than systems fit for high-stakes scenarios in which users may unwittingly apply them? This paper argues for the need to integrate rigorous SE processes into the agentic loop to produce production-grade, hardened, and deterministically-constrained agent *workflows* that substantially outperform the potentially brittle and vulnerable results of on-the-fly synthesis. Doing so may require extra compute and time, and if so, we must amortize the cost of rigor through reuse across a broad user community. We envision an *AI Workflow Store* that consists of hardened and reusable workflows that agents can invoke with far greater reliability and security than improvised tool chains. We outline the research challenges of this vision, which stem from a broader flexibility-robustness tension that we argue requires moving beyond the ``on-the-fly'' paradigm to navigate effectively.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 25 of its 62 references that are in the map. First posted on arXiv 11 May 2026.
Builds on
25 of 62 references.
References · 25
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2024A Survey on LLM-as-a-Judgecited by 1,423
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
- 2025Defeating Prompt Injections by Designcited by 297
- 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 210
- 2022Do Users Write More Insecure Code with AI Assistants?cited by 192
- 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systemscited by 130
- 2025LlamaFirewall: An open source guardrail system for building secure AI agentscited by 127
- 2025Securing AI Agents with Information-Flow Controlcited by 121
- 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
13 more
- 2024AirGapAgent: Protecting Privacy-Conscious Conversational Agentscited by 94
- 2025Contextual Agent Security: A Policy for Every Purposecited by 59
- 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 55
- 2025Fully Autonomous AI Agents Should Not be Developedcited by 45
- 2025ASIDE: Architectural Separation of Instructions and Data in Language Modelscited by 24
- 2025AgentBound: Securing Execution Boundaries of AI Agentscited by 23
- 2024Specifications: The missing link to making the development of LLM systems an engineering disciplinecited by 17
- 2025Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerouscited by 12
- 2025Privacy Reasoning in Ambiguous Contextscited by 11
- 2025Sherlock: Reliable and Efficient Agentic Workflow Executioncited by 11
- 2026Optimizing Agent Planning for Security and Autonomycited by 10
- 2026AC4A: Access Control for Agentscited by 5
- 2026An AI Agent Execution Environment to Safeguard User Datacited by 4
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025A Practical Guide for Designing, Developing, and Deploying Production-Grade Agentic AI Workflows
- 2026Workflow-GYM: Towards Long-Horizon Evaluation of Computer-use Agentic tasks in Real-World Professional Fields
- 2025A Survey on Agent Workflow -- Status and Future
- 2026Rethinking Software Engineering for Agentic AI Systems
- 2026Agentic Software: How AI Agents Are Restructuring the Software Paradigm
- 2026Authenticated Workflows: A Systems Approach to Protecting Agentic AI
- 2026AgentSWE: Can Coding Agents Build the Agent You Actually Want?
- 2025From Correctness to Collaboration: Toward a Human-Centered Framework for Evaluating AI Agent Behavior in Software Engineering