How OpenAPPA Uses Information Flow Control to Halt Agent Breaches

Key takeaways

• episodes, OpenAPPA recorded a 0% attack success rate while maintaining utility up to 91%.
• Structured recovery semantics—such as payload sanitizers, authority routing, and disposable child branches—prevented utility collapse, which otherwise dropped task completion to 35.0%.

Archestra has released OpenAPPA, an open-source security engine designed to stop prompt injection and data exfiltration across autonomous AI agent environments. Rather than relying on secondary language models or probabilistic filters to inspect tool calls, OpenAPPA executes outside the agent’s prompt and execution loop as a deterministic reference monitor. Based on formal research detailed in an arXiv paper, the system implements Information Flow Control (IFC) by tracking data origins, audience permissions, and trust transitions across multi-tool trajectories. In enterprise evaluations, OpenAPPA sustained an 88% to 90% task completion rate with a 0% attack success rate, outperforming probabilistic frameworks.

The operational breakdown of probabilistic LLM judges

As autonomous coding assistants and workflow agents gain access to enterprise systems, engineering teams face significant security hurdles. The prevalent industry response to tool-calling risks involves deploying a secondary language model to evaluate each intended action. Architectures such as Claude Code’s auto mode, OpenAI Codex’s auto-review, and similar supervisor models operate probabilistically. While helpful for triage, they introduce distinct structural vulnerabilities when defending against adversarial actors.

First, an evaluator model checking individual tool calls cannot track information flow across an extended multi-step trajectory. When an agent reads an internal database in step two and prepares an outbound web request in step ten, a per-call judge assesses the outbound call in isolation. Second, supervisor classifiers are themselves susceptible to indirect prompt injection. To mitigate this vulnerability, execution harnesses frequently conceal tool outputs from the evaluator, preventing the judge from inspecting the actual data being processed. Third, probabilistic classifiers encounter statistical limits; even systems achieving 99.3% accuracy allow approximately 0.7% of adversarial calls to proceed. In high-throughput enterprise deployments executing millions of tool calls, that fraction represents substantial exposure.

Basic denylists and allowlists exhibit similar weaknesses. Language models reliably discover functional workarounds, such as substituting a denied shell deletion command with an equivalent Python execution script. Conversely, broadening denylists typically causes utility failure, preventing agents from completing legitimate tasks. Security teams have learned that AI agent security requires more than just a kill switch or static tool blocks. Effective protection demands continuous, deterministic governance over data movement.

How the APPA algebra enforces information flow control

OpenAPPA addresses these limitations through an Agentic Permissions Policy Algebra (APPA), formulated by researchers Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov, Ildar Iskhakov, and Matvey Kukuy. OpenAPPA operates as a pluggable engine outside the agent’s execution context. Because the underlying model cannot inspect, prompt, or negotiate with the monitor, adversarial inputs embedded in external data cannot persuade the engine to relax its rules.

Policies are declared in a centralized appa.toml configuration file. The engine models information flow through two primary security labels: audience and trust. Audience defines the authorized set of data recipients, while trust measures the verified provenance of the information. Both labels compose monotonically through lattice algebra, meaning security constraints can only become more restrictive over the course of an execution trajectory:

• Audience narrowing: Ingesting restricted records, such as confidential CRM entries or internal source repositories, immediately narrows the permitted audience of the entire trajectory to internal consumers.
• Trust degradation: Ingesting untrusted external inputs, such as scraping arbitrary web pages, reduces the trajectory’s trust label to suspicious, prohibiting subsequent privileged system actions.

Every tool integration specifies an explicit contract with three primary operational attributes:

1. Requires: The prerequisite audience permissions and trust levels needed before tool dispatch is allowed.
2. Delta: The security state modifications applied to the trajectory when the tool returns data.
3. Effects: An immutable audit record documenting confirmed operations.

For example, if an agent uses a tool named get_ticket_from_crm, the contract sets a delta that narrows the trajectory audience to ["internal"]. A subsequent tool call to publish_update, which requires an audience containing ["public"], is deterministically blocked. Similarly, executing read_web_page degrades trust to "suspicious", which prevents dispatching apply_db_migration because database operations require a "trusted" credential state.

Preserving utility with structured recovery semantics

Strict information flow control historically suffered from operational fragility: over-constrained security boundaries often paralyzed autonomous systems. As noted in Archestra’s documentation, agent security balances two critical axes: an agent that permits unauthorized data flows is unsafe, but an agent that rejects valid work is useless.

To avoid utility collapse, OpenAPPA incorporates structured recovery semantics that activate when an action violates policy. Instead of terminating the session, the engine halts dispatch and evaluates predefined recovery pathways:

Get the Weekly Brief

Curated analysis for tech leaders. Every Thursday.

Subscribe

• Sanitizers: Automated filters edit data payloads before dispatch. For instance, stripping personally identifiable information (PII) or internal server paths allows a payload’s audience to expand back to public thresholds.
• Authorities: Actions requiring elevated trust can route execution to an internal verification API or human operator for single-action approval.
• Disposable child branches: When an agent must inspect untrusted external data to complete an internal task, OpenAPPA confines the read operation to a transient child branch. The child subagent processes the untrusted input in isolation and returns only schema-attested, sanitized outputs to the parent agent, keeping the primary trajectory untainted.

Ablation experiments reported in the research paper demonstrate the operational necessity of these mechanisms. When recovery pathways were disabled during benchmark evaluations, task completion dropped from 89% down to 35.0%, illustrating that automated remediation is vital for sustaining agent productivity under strict security rules.

Benchmark evidence across Bench-Corp and AgentThreatBench

The security and utility guarantees of OpenAPPA were tested across two major testing suites: Bench-Corp and OWASP AgentThreatBench. Bench-Corp evaluates multi-step enterprise workflows, examining resilience against sensitive data leakage, prompt injection, ordering manipulation, and tenant cross-contamination. OWASP AgentThreatBench operationalizes the OWASP Top 10 for Agentic Applications into executable environments and has been integrated into the UK AI Safety Institute’s inspect_evals repository.

According to published benchmark evaluations and reporting from InfoQ, testing across 1,320 guarded benchmark episodes spanning models such as GPT-5.6 Luna, DeepSeek V4 Flash, and Gemini 3.7 Flash demonstrated complete containment of tested attack vectors:

While Claude Code’s auto mode maintained a high task completion rate of 90%, it permitted 10% of adversarial attacks to succeed. Microsoft FIDES allowed 31% of attacks on Bench-Corp while completing only 41% of assigned enterprise tasks. OpenAPPA saturated both security benchmarks with a 0% attack success rate while maintaining utility within one percentage point of unconstrained agents.

Implementation constraints and operational overhead

Engineering leaders evaluating OpenAPPA should account for several practical constraints. First, OpenAPPA is currently released as a technical preview. While the mathematical foundations of its lattice algebra are sound, enterprise production deployment requires testing tool definitions against custom internal APIs.

Second, establishing declarative contracts in appa.toml introduces upfront authoring overhead. Platform engineers must categorize every tool’s audience boundaries and trust deltas accurately. Misconfiguring a delta by making it overly restrictive can trigger unnecessary authority escalations or frequent child branching, which introduces network latency and token overhead.

Third, integration requires platform-level access to the agent harness. Because OpenAPPA functions as an external reference monitor at tool dispatch and gateways, it cannot simply be injected as a system prompt addition. Teams using closed, hosted agent platforms that restrict orchestration hooks cannot leverage its external reference monitor until those platforms support external policy gateways.

Bottom line

OpenAPPA provides compelling empirical evidence that deterministic Information Flow Control outperforms probabilistic LLM evaluators in securing agentic workflows. By relocating security enforcement outside the prompt loop and adopting lattice-based state transitions, the engine stops prompt injections and data leaks without breaking agent utility. Development teams deploying tools like Claude Code, Cursor, or Copilot CLI in sensitive enterprise environments should examine OpenAPPA’s open-source preview to benchmark their vulnerability surface against deterministic standards.

Sources

• New Archestra’s OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate – InfoQ
• [2607.24625] APPA: Recoverable Information-Flow Control for Real-World LLM Agents
• Benchmarks — OpenAPPA
• GitHub – archestra-ai/OpenAPPA: Deterministic guardrails that don’t break agents · GitHub
• inspect_evals/src/inspect_evals/agent_threat_bench at main · UKGovernmentBEIS/inspect_evals · GitHub