LEANGUARD: Lean-Verified Guardrails for Tool-Using Agents

Summary

LeanGuard is a runtime that checks each tool call an LLM agent proposes against a policy written in Lean4 before the call executes, using fail-closed evaluation over state predicates and scoped past-time temporal operators. On Tau-Bench with five Qwen models (0.8B-27B), unguarded agents executed at least 33 forbidden calls while LeanGuard executed none, and on DTap it cut direct prompt-injection success from 57.9% to 5.9%.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)