The next agent safety layer looks ahead (2026)

The guard has to see the next step

Three fresh signals point in the same direction. A red-team framework makes its attacks stronger by first learning how an agent stores and uses information. A safety model predicts what a partial trajectory is likely to become before allowing the next tool call. A long-horizon reasoning system keeps a complete interaction log and searches it with code instead of compressing the past into a lossy summary.

The practical shift is from checking a prompt or an isolated action to evaluating a trajectory. That changes what builders should measure: reconnaissance coverage, delayed harm, memory retrieval cost, and whether credentials ever enter the model context.

Research signals

Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents

Method. KYA treats an agent like a pentesting target that must be profiled before it is attacked. Its reconnaissance module probes the agent's behavior and information assets, then selects tactics for exploitation. The evaluation used AgentDojo, InjecAgent, and the OpenHands coding agent, with up to three tactics and ten exploitation attempts per run. 1

Evidence. On AgentDojo, KYA reported an 86.0% attack-success rate; on InjecAgent it reported 99.3%. The paper says reconnaissance was the main contributor in its ablation: 34% of successful cases appeared only when reconnaissance was present, while tactics alone added 4%. On OpenHands, the overall attack-success rate was 21.9%, with 35.0% on the paper's risky objectives and 8.9% on dangerous objectives. 1

Follow-up test. Do not evaluate indirect prompt injection only with static strings such as "ignore previous instructions." Give the attacker a limited interaction budget and let it learn your agent's tool descriptions, memory conventions, and workflow assumptions. KYA is a preprint and its iterative baselines are described as best-effort reproductions, so the result is a strong test design signal rather than a production attack-rate forecast.

JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety

Method. JANUS trains Vanguard to make two linked judgments: anticipate safety-relevant futures from a partial trajectory, then adjudicate the current action using both the observed prefix and the forecast. The paper evaluates it on AgentDojo, Agent-SafetyBench, AgentLAB, and LPS-Bench. 2

Evidence. Vanguard's average attack-success rate was 0.071, compared with 0.230 across six guard baselines and 0.397 with no guard. The authors report a 15.9 percentage-point improvement in protection over baseline guards and a 5.1 percentage-point increase in benign task completion. Those numbers come from the paper's benchmark setup, not an independent deployment study. 2

Follow-up test. A useful production analogue is a two-pass policy: first ask a guard what the current tool call could enable several steps later, then decide whether to allow, constrain, or escalate the call. The test should score both delayed unsafe outcomes and false blocks on normal workflows. A guard that only recognizes the current tool name will miss risks that appear after a successful chain of ordinary-looking calls.

PRO-LONG: Programmatic Memory Enables Long-Horizon Reasoning

Method. PRO-LONG keeps every observation, action, and outcome in a structured interaction log. It does not summarize the log at write time. Instead, the coding agent searches the history with grep, regular expressions, and Python when it needs a prior state. The July 23 version evaluates this approach on all 25 public ARC-AGI-3 games, where the agent must infer rules while exploring unfamiliar environments. 3

Evidence. The paper reports an average 18.0 percentage-point improvement over a base coding agent across frontier models, up to 76.1% pass@1, and 4.2–5.8 times fewer tokens than specialized harnesses. With Fable 5, it reports 97.4% best@2 at a total cost of $1,750. These are reported benchmark results from a preprint, so the cost and performance should be checked against the exact model prices and run configuration before reuse. 3

Follow-up test. Before adding another learned memory layer, try a lossless event log with explicit fields for step, state, action, outcome, and score. Measure retrieval latency, tokens per successful recovery, and the percentage of decisions that depend on a retrieved fact. This makes memory failures inspectable instead of hiding them inside a summary prompt.

Release watch: interoperability is becoming an SDK surface

Microsoft's Agent Framework added a prerelease A2A hosting package on July 23 with progressive adapters for agents and workflows, native card generation, skill discovery, typed conversion, and mode-aware validation. Its python-github-copilot-1.0.0 release also moved the GitHub Copilot adapter to stable and added pass-through for image, document, and other inline binary attachments. 4 5

The interesting part is not another model wrapper. It is the expansion of the contract around an agent: how it advertises skills, converts typed inputs, validates modes, and carries non-text artifacts across a provider boundary. The A2A package is prerelease, so teams should test schema rejection, attachment size limits, and failure recovery before treating the adapters as stable infrastructure.

Industry and builder signals

AegisAI, founded by former Google security executives, raised a $36 million Series A led by Battery Ventures, with Accel and Foundation Capital participating. TechCrunch reports that the company has AI agents inspect incoming email for contextual anomalies and says its tools are used by dozens of customers, including LangChain. The customer count and detection claims are company-reported; the funding and product description are the verified news. 6

The more important design choice is the investigation loop. AegisAI is selling an agent that reads context and reasons about anomalies, rather than a larger list of static email rules. That same pattern raises the question the research papers make harder to avoid: what happens when the defender's own agent is manipulated, and what evidence does it retain for an analyst to review?

A small open-source project on Hacker News answers the credential part with a deliberately narrow boundary. OneCLI's Show HN post describes a network gateway that matches a request by host and path, checks policy, swaps a placeholder for the real credential, and forwards the call. The agent can use an HTTPS proxy without receiving the secret. The authors say approvals are enforced at the network layer, including for MCP, CLI, curl, or code generated during a run; they also describe Rust and Next.js components, AES-256-GCM encryption at rest, and optional retrieval from Bitwarden or 1Password. 7

OneCLI's own warning is the part to keep: a gateway does not stop an agent from misusing access it legitimately has. It makes credential exposure and network policy easier to control, but authorization scope still has to be tight and the high-impact paths still need approval.

What to build next

For agent security: add adaptive reconnaissance to red-team runs, then test a predictive guard against the same trajectories. Static injection strings are not enough for a system whose weaknesses depend on memory, tools, and workflow state.
For long tasks: start with a complete, queryable event log. Compare it with summarization on recovery rate and token cost before adopting a more complex memory architecture.
For integrations: treat A2A handoffs and binary attachments as security-sensitive interfaces. Validate types and modes at the boundary, and keep credentials in a network or tool gateway rather than the model context.
For investors and founders: distinguish an agent that can investigate from one that can prove what it investigated. The emerging product surface is the trail, the policy decision, and the ability to replay a failure.

The new agent stack is becoming predictive on both sides of the boundary. Attackers are learning the workflow before acting; defenders are forecasting the next state; long-horizon agents are turning memory into a searchable program. The teams that can make those traces cheap to inspect will have the clearest path from a convincing demo to a system they can safely leave running.

The next agent safety layer looks ahead