StepGuard: An AI Agent Must Not Act Without a Brake
mlj.solutions
mlj.solutions AI agent nesmí bez kontroly odesílat, zapisovat ani mazat. Nová studie ukazuje, že kontrola jednotlivých kroků snížila úspěšnost útoků o 77,3 % při malém poklesu užitečnosti. 📄Paper: https://arxiv.org/abs/2608.24777
View on InstagramWhat the study is about
AI agents use tools and can modify files, leak sensitive information or carry out an unauthorized action. Most safeguards, however, only evaluate the finished run. StepGuard is a model that monitors every step of the agent and stops a risky action before it is carried out.
Statistics
77.3%
fewer successful attacks
With agents protected on the AgentDojo and AgentDyn benchmarks, the average attack success rate fell by 77.3% compared with no protection.
2.8 pp
drop in agent utility
For this protection, the agent paid only 2.8 percentage points of utility, so it remained usable.
2
check modes
StepGuard can check an action before it is executed and also retrospectively evaluate an agent run that has already finished.
What this means
- Checks must happen before the action, protection that evaluates only the finished run comes too late, because the damage may already be done.
- Security doesn't have to cost performance, the protection reduced the success rate of attacks significantly while the agent's utility dropped only slightly.
- Protection must be balanced, a guard that is too strict blocks harmless actions, one that is too loose lets dangerous ones through, and the Balance-GRPO method tries to keep the balance.
- Training data can be created automatically, the StepGen tool generates safe and unsafe runs with the same context that differ only in the risky step.
- An open model matches the top tier, StepGuard achieved the highest accuracy among open-weight guard models and comparable to GPT-5.4.
Our take
It isn't enough to check an agent with access to your tools after the action. The check has to happen before the action is carried out, and it must not slow the agent down unnecessarily.
Michal Dobrovolný
Founder & CTO
Zdroj
Zheng, Z., Li, Y., Qian, C., Fu, Y., Fu, Y., Sheng, L., Shao, J., & Liu, D. (2026). StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing. arXiv:2608.24777. https://arxiv.org/abs/2608.24777
Don't miss these posts
When More Agents Pay Off and When They Don't
More AI agents don't necessarily mean a better result. A study shows that what matters is how much information is lost when it is passed between agents.
AI Remembers a Claim Even When You Tell It It's False
When a model is fine-tuned on documents that deny a claim, it often learns the claim as true anyway. The authors named this effect Negation Neglect.
The Skill That Explains Anything to Anyone
ELI5 is an open-source skill for Claude Code that adapts explanations to the audience. With the skill it passed 10 of 12 criteria, without it only 5.
Want to implement AI in your company?
We'll go through your needs together and propose an approach that delivers measurable results.
Write to us
