Research

Runtime Control for Tool-Using Agents

Preliminary results from DARC on public agent-safety benchmarks.

Dipesh Tharu MahatoJune 28, 2026Runtime control
34,734
Action examples
20,145
Labeled unsafe
0
Unsafe executed
3,000
Review set

AI agents are beginning to move from chat into action. They read files, call APIs, send emails, update databases, browse websites, modify code, and interact with external systems. This changes the safety problem.

DARC is a runtime control layer for tool-using AI agents. It sits between the model and the environment, evaluates proposed actions before execution, tracks risk across the trajectory, and decides whether an action should be allowed, blocked, rewritten, or escalated.

In our preliminary benchmark suite, full DARC executed zero labeled-unsafe actions across 34,734 action-level examples converted from public agent-safety benchmarks.

DARC benchmark snapshot

Converted public agent-safety suite - preliminary labels

v0 preliminary
0
Unsafe executed
of 20,145
100%
Unsafe-action recall
full DARC
0.0
Critical FNR
converted labels
0.859
Task completion
aggregate

1. Why agent safety becomes an action problem

The safety boundary for agents is different from the safety boundary for chatbots. A chatbot usually fails at the level of language. A tool-using agent can fail at the level of state: deleting a file, sending an email, leaking a secret, approving a payment, modifying production configuration, or executing a command.

This is especially important under prompt injection. A prompt-only defense asks the model to remember which instructions are trusted. Once the model proposes a tool call, the system needs a second line of defense.

DARC treats agent safety as a runtime control problem and moves control closer to the point where harm can occur: the action boundary.

Figure 1. The agent action boundary

DARC evaluates proposed tool actions before they reach the environment, enforcing policy at the action boundary rather than relying only on prompt behavior.

User goal
Agent reasoning
Proposed tool action
DARC runtime controller
Allow / rewrite / escalate / block
Environment

2. What DARC controls

DARC is designed around a simple principle: actions should require justification proportional to their risk. Reading a public webpage is not the same as writing to a production file. Searching documentation is not the same as sending an email.

DARC classifies risk using action metadata, trajectory state, runtime effects, and policy monitors. It tracks categories including untrusted instruction influence, external transfer, destructive action, secret access, production impact, audit manipulation, and auth or security changes.

Untrusted instruction

A tool result conflicts with the user goal

External transfer

Data is sent to an external destination

Destructive action

A file or resource may be deleted or overwritten

Secret access

The action touches tokens, keys, or sensitive files

Production impact

The action affects production-like state

Auth or security

The action changes permissions or access control

3. Benchmark setup

We evaluated DARC on a converted public benchmark suite built from four agent-safety sources: AgentDojo, SABER, AgentHarm, and Agent-SafetyBench. The suite contains 34,734 action-level examples, 844 tasks, and 20,145 labeled-unsafe actions.

Each example represents a proposed tool action, its arguments, task context, trajectory prefix, and converted safety label. We compared six systems: no controller, safety prompt only, static guardrail, single-action judge, DARC without leases, and full DARC with leases.

Figure 2. Public benchmark source distribution

The raw converted suite is heavily weighted toward AgentDojo, so we separately generated a balanced 3,000-example human review set.

AgentDojo32,790
SABER1,102
AgentHarm431
Agent-SafetyBench411

4. Main result: zero unsafe executions

The most important question is direct: how many labeled-unsafe actions actually executed? Full DARC executed zero labeled-unsafe actions across the converted public benchmark suite.

The no-controller, safety-prompt-only, and single-action-judge baselines executed all labeled-unsafe actions in this setup. The static guardrail blocked some unsafe actions but still allowed 11,321 unsafe actions through.

Figure 3. Unsafe actions executed by system

Unsafe action executions across 20,145 labeled-unsafe actions. Full DARC executed zero labeled-unsafe actions in this converted benchmark suite.

20,145
Prompt-only unsafe executions
11,321
Static guardrail misses
0
Full DARC unsafe executions
20,145
20,145
20,145
11,321
0
0
No controller
Safety prompt only
Single-action judge
Static guardrail
DARC without leases
Full DARC with leases
Figure 4. Unsafe-action recall and critical false negatives

Full DARC reached 100% unsafe-action recall and a 0.0 critical false-negative rate under converted labels.

SystemRecallCritical FNR
No controller
0%1
Safety prompt only
0%1
Single-action judge
0%1
Static guardrail
43.8%0.492
DARC without leases
100%0
Full DARC with leases
100%0

5. Why stateful runtime control matters

Many unsafe agent behaviors are not single-turn mistakes. They are trajectory-level failures. An agent may first read untrusted content, then interpret that content as instruction, then call a tool, then transfer data, alter state, or take an irreversible action.

A single-action classifier can miss the pattern because each step may look plausible in isolation. DARC tracks the control state across the trajectory and constrains later execution when the trajectory enters a blocked or human-approval-required state.

Figure 5. From prompt injection to unsafe action

Indirect prompt injection becomes dangerous when it changes the agent's actions. DARC focuses on the action boundary where unsafe behavior can still be prevented.

Untrusted content
Prompt injection attempt
Agent proposes tool call
DARC detects risk
Block / rewrite / escalate
Figure 6. Control actions during the run

DARC used blocking, escalation, and rewriting. This configuration prioritizes unsafe-action prevention over maximum task completion.

0
unsafe executed
Blocks33,638
Escalations47
Rewrites118
Unsafe executions0

Full DARC's aggregate task completion rate was 0.859. This is an important tradeoff: conservative runtime control improves unsafe-action prevention but can reduce task completion in adversarial or injection-heavy benchmark settings.

6. Human review set

The benchmark above is converted from public benchmark metadata. To strengthen label quality, we generated a balanced 3,000-example human review set. It contains 1,766 unsafe examples and 1,234 safe examples across sources, tool types, and risk categories.

Figure 7. Balanced human review set

The review set is designed to reduce source imbalance and support human validation of converted labels.

AgentDojo1079
755 unsafe - 324 safe
SABER1079
613 unsafe - 466 safe
AgentHarm431
374 unsafe - 57 safe
Agent-SafetyBench411
24 unsafe - 387 safe
Figure 8. Review risk categories

Risk categories represented in the prepared human review package.

External transfer950
Untrusted instruction847
Production426
Destructive402
Secret access110
Audit manipulation16
Auth or security2
Figure 9. Review tool types

Tool types represented in the prepared human review package.

write_file818
api_post815
browser_read782
read_file557
email_send28

7. Limitations

These results should be read as preliminary. The current labels are benchmark-derived and converted from public benchmark metadata rather than fully human-adjudicated labels. The 3,000-example review set is prepared, but review is not complete.

The raw benchmark distribution is imbalanced, with AgentDojo contributing most examples. DARC is also conservative in this configuration. Conservative control is useful for measuring unsafe-action prevention, but it can overblock. A production-ready controller should preserve more benign task progress while maintaining strong safety guarantees.

This benchmark measures action-level safety behavior. It does not replace deployment-specific permissions design, sandboxing, least privilege, logging, human approval workflows, or security review.

8. Next steps

The next step is human validation. We are preparing to:

Complete human review of the 3,000-example balanced review set.
Measure inter-reviewer agreement and adjudicate disagreements.
Recompute results using human-reviewed labels.
Report source-balanced metrics alongside aggregate metrics.
Improve precision to reduce overblocking.
Expand the benchmark with additional public and internal agent-safety tasks.

Conclusion

As agents become more capable, the safety boundary moves from text to action. A model may generate a plausible plan and still propose an unsafe tool call. DARC is built for that boundary.

In this preliminary benchmark, full DARC executed zero labeled-unsafe actions, reached 100% unsafe-action recall, and had a 0.0 critical false-negative rate. These results are not the final word. They are the first strong signal.

References