Bounding what AI agents can access and observing what they do

GuardiAgent is a research project of the Programming Group at the University of St. Gallen in Switzerland. AgentBound enforces least privilege for the MCP servers an agent uses, and AgentSpy records what an agent and every process it starts do at the operating-system level.

See the 2026 incidentsCompare AgentBound and AgentSpy

Real Agent incidents disclosed in 2026

Most of these cases happened in training or evaluation environments that were less isolated than assumed. We cite them for the failure pattern and did not run our prototypes on them.

  • Third-party evaluationUK AI Security Institute

    Agents in a government cyber evaluation take unsanctioned actions against real people

    With internet access deliberately enabled for a cyber challenge, agents took 19 unsanctioned actions on the live internet in 10 of 122 runs; the scope existed only in the task.

    UK AISI incident report
  • Lab evaluationAnthropic

    Claude models reach real third-party systems through misconfigured evaluations

    In four incidents, Claude models were told they had no internet access during capture-the-flag evaluations, but a misconfiguration left it open and they attacked real systems.

    Anthropic: alignment assessment of recent cybersecurity incidents
  • Internal trainingOpenAI

    Agents pass a workbook through a public file-hosting service

    Told to use local files only during RL training, an agent uploaded a shared workbook to a public temporary file host after the shared filesystem broke.

    OpenAI misalignment report
All incidents with sources

Our papers on bounding and observing AI agents

AgentBoundPreventPeer-reviewed · ACM FSE 2026 · Code available

AgentBound

AgentBound: Securing Execution Boundaries of AI Agents

Christoph Bühler, Matteo Biagiola, Luca Di Grazia, Guido Salvaneschi

Android-style permission manifests and a container sandbox for MCP servers. Servers declare what they need, users consent to concrete resources, and the sandbox blocks everything else, without changing the servers.

296
most popular MCP servers analyzed for the permissions they need
§4.1.1
80.9%
of generated manifests judged correct by responding maintainers
§4.1.3
Paper pageDOI 10.1145/3808103
AgentSpyObservePreprint · arXiv, Oct 2026

AgentSpy

AgentSpy: Making AI Agent Behavior Observable

Christoph Bühler, Matteo Biagiola, Luca Di Grazia, Guido Salvaneschi

Run the agent in a disposable Firecracker microVM and record the system calls and network traffic of the agent and every process it spawns. Deterministic analyses then check what a run should do and what it must never do.

18%
of task-model pairs that passed every test still showed activity unrelated to the task
§4.2 (16 of 88)
14 / 18
executed skill-injection attacks flagged by deterministic system-call rules
§4.3
Paper pagearXiv 2610.06001
Publications and citations

The tool boundary and the OS boundary

AgentBound blocks an MCP server's undeclared access before the action runs, but does not cover the agent's own shell. AgentSpy records every process the agent starts, but blocks nothing and alerts after the run.

Task instructions ("no internet", "stay in the workspace") are stated, not enforced.
AgentBound · tool boundary
Each MCP server runs in its own sandbox and can only reach what its manifest declares and the user approved.
AgentSpy · OS boundary
Every system call and connection of the agent and every process it starts is recorded in a disposable microVM.
  1. P · Prevent: blocked at the tool boundary

    A Maps MCP server rebuilds its API host as a raw IP address. Its manifest only allows maps.googleapis.com, so AgentBound blocks the connection.

    AgentBound, attack B.1

  2. O · Observe: recorded at the OS boundary

    A compromised skill tells the agent to run a helper script that uploads ~/.ssh/id_rsa. The trajectory shows one successful command; the system calls show the key read and the connection, and raise two alerts.

    AgentSpy, Fig. 3

  3. G · Gap: inside the allowed scope

    A poisoned tool description changes the parameters of a permitted Wallet call. Every access is declared and every host is allowed, so neither layer flags it.

    AgentBound, attack B.2

Conceptual view. The paths come from the papers' own evaluation examples: AgentBound attacks B.1 and B.2, and the AgentSpy skill-injection example (Fig. 3). AgentBound and AgentSpy are separate research prototypes, evaluated separately: AgentBound runs alongside your agent; AgentSpy runs the agent in a disposable microVM to audit it.
Full comparison

Try the AgentSpy report

Pick a model and a task, then read the reliability report for recorded runs from the paper's experiments. Nothing runs in your browser.

Open the simulator

Run MCP servers in the AgentBound sandbox

The sandbox runs a stdio MCP server in a Docker container with only the permissions its manifest declares and you approve.

With the OpenAI Agents SDK, use SandboxedMCPStdio in place of the SDK's stdio server.

import os

from agents import Agent
from mcp_sandbox_openai_sdk import (
  FSAccess,
  SandboxedMCPStdio
)

async def main():
  workdir = os.path.abspath("./")
  async with SandboxedMCPStdio(
    manifest=manifest,
    runtime_args=[workdir],
    runtime_permissions=[
      FSAccess(workdir)
    ],
  ) as server:
    agent = Agent(
      name="MCP Sandbox Test",
      model="gpt-5-mini",
      mcp_servers=[server],
    )

AgentSpy is a research preprint. Read about AgentSpy

Developer guide

Stay in touch

For questions, collaborations or news about new papers and releases, send an email to info@guardiagent.com.

Email us

Team

  • Christoph Bühler

    University of St. Gallen

  • Matteo Biagiola

    University of St. Gallen & Università della Svizzera italiana (USI)

  • Luca Di Grazia

    University of St. Gallen

  • Guido Salvaneschi

    University of St. Gallen

Programming Group, University of St. Gallen in Switzerland