AI agents that look safely distant from a malicious prompt might actually be one hop away from disaster.
Researchers built a provenance-aware execution graph that traces how agent actions actually connect through shared state, identifiers, and tool calls, rather than just counting steps in the trajectory. They call this "influence distance" and compare it to the standard "sequence distance" used to count steps between an injected prompt and a risky action. Testing 454 injection-to-action pairs across 360 long-horizon AgentDojo trajectories on OpenAI's GPT-4o-mini and GPT-4o and Anthropic's Claude Haiku 4.5 and Sonnet 4.6, they found the two distances diverged in 96.9% of pairs, with a median gap of 9 hops. On AgentDojo's banking benchmark, 33.8% of 231 pairs stayed structurally connected through different provenance paths even when they looked temporally far apart.
This matters because agent security tools that rely on step-count heuristics - "that malicious input is 20 actions ago, we're fine" - may be measuring the wrong thing entirely. The researchers built a pre-execution gate using influence distance instead, and it caught five attack sinks a sequence-based gate missed without blocking any extra legitimate actions - though the gap's link to attack success didn't reach statistical significance after controlling for other factors (p=.088), and the gate's own improvement fell just short of significance too (p=.0625).
Both headline results sit right on the edge of significance, so read this as a plausible early signal, not proof - the researchers themselves are careful to call it "candidate influence pathways" rather than confirmed causal attribution.