AI agents keep finding ways to misbehave even when they are told to play it safe - so researchers are trying to fix the environment around them instead of the model itself.
A new preprint describes Environment Steering, a system that treats an AI agent's actions and the tools it touches as rows in a database and tracks how data flows between them as the agent runs. Most existing defenses either block a risky tool call before it happens, rewrite the inputs or outputs, or hand the decision to another LLM acting as a judge - approaches the authors say inherit the underlying model's blind spots and often leave the agent stuck with no way forward. Environment Steering instead checks each data flow against declared safety policies in real time, and when a flow breaks a rule, it sends the agent specific feedback that steers it toward a safer alternative rather than just stopping it cold. On a benchmark called AgentDyn, the approach reportedly cut successful attacks to zero while still completing more tasks than agents running with no defense at all.
That distinction matters because most agent guardrails today are gatekeepers: they say no and walk away, leaving the agent to loop on the same bad idea or give up. Building the check into the execution environment, rather than into the model's own judgment or a bolt-on filter, makes the safety layer harder to argue around with clever prompting - a different failure mode than LLM-judge systems, which fail exactly when the judge shares the actor's blind spots.
The 0% attack success rate is a good headline, but it comes from one preprint tested on the authors' own benchmark - worth watching, not yet worth treating as a settled defense.