mlsanityData to 7 Oct 2026

Agentao: A Policy-Governed Runtime Harness for Embeddable Tool-Using LLM Agents

arXiv 2608.13574 ↗First posted 4 Jul 2026cs.AI cs.MAcited by 1

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

LLM agents increasingly operate as execution systems that invoke tools, modify local state, use persistent memory, and interact with external protocols. These capabilities make agents useful, but they also introduce risks related to over-privileged actions, weak auditability, prompt injection, tool poisoning, and uncontrolled side effects. This paper presents Agentao, a governed local-first runtime for tool-using LLM agents. Agentao separates model-generated action proposals from host-authorized execution through a layered architecture consisting of host-facing surfaces, a host contract, a runtime core, a permission-mediated tool system, and supporting subsystems for memory, replay, plugins, skills, sub-agents, and protocol integration. We describe the motivation, threat model, design goals, governance model, execution pipeline, and structured event interface of the system. Agentao does not provide formal safety guarantees; rather, it demonstrates how permissions, state, protocol boundaries, and execution traces can be made explicit runtime abstractions for building agents that are more governable, inspectable, and suitable for host-controlled local environments. The code is publicly available at https://github.com/jin-bo/agentao .

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 28 of its 31 references that are in the map. First posted on arXiv 4 Jul 2026.

Builds on

28 of 31 references.

Closest ancestors · 3

Same direction, newest first

  1. 2026Towards Verifiably Safe Tool Use for LLM Agents12 Jan
  2. 2025MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers17 Dec
  3. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct

Other references · 25

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  3. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
  4. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  5. 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
  6. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
  7. 2023Voyager: An Open-Ended Embodied Agent with Large Language Modelscited by 2,081
  8. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  9. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
  10. 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,628
  11. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,422
  12. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
13 more
  1. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,302
  2. 2023HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Facecited by 1,173
  3. 2023GAIA: a benchmark for General AI Assistantscited by 1,084
  4. 2024Large Language Model based Multi-Agents: A Survey of Progress and Challengescited by 752
  5. 2023API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMscited by 574
  6. 2023Language Agent Tree Search Unifies Reasoning Acting and Planning in Language Modelscited by 551
  7. 2023Cognitive Architectures for Language Agentscited by 422
  8. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  9. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 257
  10. 2024OS-Copilot: Towards Generalist Computer Agents with Self-Improvementcited by 203
  11. 2023TaskMatrix.AI: Completing Tasks by Connecting Foundation Models with Millions of APIscited by 184
  12. 2022MRKL Systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoningcited by 153
  13. 2024AIOS: LLM Agent Operating Systemcited by 94

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Auditcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
  2. 2026AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems
  3. 2025AgentGuard: Repurposing Agentic Orchestrator for Safety Evaluation of Tool Orchestration
  4. 2026A Policy-Driven Runtime Layer for Agentic LLM Serving
  5. 2026OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents
  6. 2026Cordon: Semantic Transactions for Tool-Using LLM Agents
  7. 2026AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent
  8. 2026When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents