Paper deep dive
Skynet: Workflow-Level Anomaly Detection for Agentic AI via Semantic and Structural Modeling
Chaoyu Zhang, Hexuan Yu, Heng Jin, Shanghao Shi, Ning Zhang, Yi Shi, Yulia R. Gel, Y. Thomas Hou, Wenjing Lou
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 9/12/2026, 3:19:37 AM
Summary
The paper introduces Skynet, a workflow-level anomaly detection framework for Agentic AI systems. Skynet converts multi-agent execution traces into directed workflow graphs and employs a dual-branch encoder to jointly model semantic execution context and structural dependencies (delegation, tool invocation, data flow). Trained exclusively on benign workflows using contrastive learning, Skynet detects both adversarial manipulations (e.g., prompt injection) and intrinsic failures (e.g., hallucinations) by identifying off-manifold geometry in the embedding space. It achieves high recall with a sub-1% false positive rate on public benchmarks.
Entities (10)
Relation Signals (9)
Skynet → detects → Agentic AI
confidence 95% · Skynet: Workflow-Level Anomaly Detection for Agentic AI
Skynet → detects → Prompt Injection
confidence 95% · Adversarial workflow manipulations arise from intentional interference such as prompt injection... Skynet is designed to detect both
Skynet → enables → Zero-day Detection
confidence 90% · this design naturally extends to zero-day detection: any execution that violates benign workflow regularities surfaces as off-manifold geometry
Skynet → evaluateson → ATBench
confidence 90% · ATBench (Li et al., 2026b) (broad safety-in-the-wild)
Skynet → evaluateson → Agent-SafetyBench
confidence 90% · We evaluate Skynet on three public agentic safety and failure benchmarks... Agent-SafetyBench
Skynet → evaluateson → AgentErrorBench
confidence 90% · AgentErrorBench (Zhu et al., 2025) (intrinsic execution failures)
Skynet → uses → Workflow Graph
confidence 90% · Skynet... turns observed multi-agent execution into directed workflow graphs
Skynet → comprises → Semantic Encoder
confidence 85% · Stage T2: dual-branch encoding... maps each workflow through a semantic encoder
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Agentic AI systems execute complex tasks through long-horizon workflows of planning, tool use, and multi-agent coordination. Task failures in these systems often originate from a single step, such as an injected prompt or a flawed plan, and are then amplified through downstream dependencies as the corrupted step propagates across many subsequent agents and tool calls. Existing defenses either target a specific class of attacks or failures, or inspect individual prompts and steps in isolation. Both leave the global dependency structure of a workflow unexamined, and miss the inconsistencies that only emerge when the execution is viewed as a whole. We argue that anomaly detection for agentic AI must reason at the workflow level, where global execution structure exposes signals that local checks cannot see. We present Skynet, a principled workflow-level anomaly detection framework that turns observed multi-agent execution into directed workflow graphs and scores them against learned benign behavior. Skynet jointly models the semantic execution context and the structural organization of inter-agent delegation, tool invocation, and data-flow dependencies, and trains only on benign workflows. Because training never sees attacks or failures, this design naturally extends to zero-day detection: any execution that violates benign workflow regularities surfaces as off-manifold geometry under a single decision rule. We evaluate Skynet on three public agentic safety and failure benchmarks. It sustains high recall together with a sub-1% false positive rate, with per-workflow and per-step latencies low enough for online monitoring of agentic AI runtimes.
Tags
Links
- Source: https://arxiv.org/abs/2609.06835v1
- Canonical: https://arxiv.org/abs/2609.06835v1
Trouble viewing inline? Open PDF directly →
Full Text
69,021 characters extracted from source content.
Expand or collapse full text
Skynet: Workflow-Level Anomaly Detection for Agentic AI via Semantic and Structural Modeling Conference: The 27th International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing; November 23–26, 2026; Tokyo, JapanCCS: Security and privacy Intrusion/anomaly detection and malware mitigationCCS: Security and privacy Distributed systems securityCCS: Computing methodologies Neural networksCCS: Computing methodologies Multi-agent systems Chaoyu Zhang Affiliation: Virginia Tech, Arlington, VA, USA email: chaoyu@vt.edu , Hexuan Yu Affiliation: Virginia Tech, Arlington, VA, USA email: hexuanyu@vt.edu , Heng Jin Affiliation: Virginia Tech, Arlington, VA, USA email: hengj@vt.edu , Shanghao Shi Affiliation: WashU, St. Louis, MO, USA email: shanghao@wustl.edu , Ning Zhang Affiliation: WashU, St. Louis, MO, USA email: zhang.ning@wustl.edu , Yi Shi Affiliation: Virginia Tech, Arlington, VA, USA email: yshi@vt.edu , Yulia R. Gel Affiliation: Virginia Tech, Blacksburg, VA, USA email: ygl@vt.edu , Y. Thomas Hou Affiliation: Virginia Tech, Blacksburg, VA, USA email: hou@vt.edu and Wenjing Lou Affiliation: Virginia Tech, Arlington, VA, USA email: wjlou@vt.edu © acmlicensed Abstract. Agentic AI systems execute complex tasks through long-horizon workflows of planning, tool use, and multi-agent coordination. Task failures in these systems often originate from a single step, such as an injected prompt or a flawed plan, and are then amplified through downstream dependencies as the corrupted step propagates across many subsequent agents and tool calls. Existing defenses either target a specific class of attacks or failures, or inspect individual prompts and steps in isolation. Both leave the global dependency structure of a workflow unexamined, and miss the inconsistencies that only emerge when the execution is viewed as a whole. We argue that anomaly detection for agentic AI must reason at the workflow level, where global execution structure exposes signals that local checks cannot see. We present Skynet, a principled workflow-level anomaly detection framework that turns observed multi-agent execution into directed workflow graphs and scores them against learned benign behavior. Skynet jointly models the semantic execution context and the structural organization of inter-agent delegation, tool invocation, and data-flow dependencies, and trains only on benign workflows. Because training never sees attacks or failures, this design naturally extends to zero-day detection: any execution that violates benign workflow regularities surfaces as off-manifold geometry under a single decision rule. We evaluate Skynet on three public agentic safety and failure benchmarks. It sustains high recall together with a sub-1%1\% false positive rate, with per-workflow and per-step latencies low enough for online monitoring of agentic AI runtimes. Keywords: Agent Security, Agent Guardrail, Workflow-Level Anomaly Detection, Graph-Based Representation Learning 1. Introduction Modern agentic AI stacks such as OpenAI’s ChatGPT Agent (OpenAI, 2025a), Anthropic’s orchestrator-worker patterns (Anthropic, 2024a), Microsoft’s AutoGen (Wu et al., 2024), and Google’s Agent-to-Agent (A2A) protocol (Google Developers Blog, 2025) compose specialized large language model (LLM) agents that plan, invoke external tools through the Model Context Protocol (MCP) (Anthropic, 2024b; OpenAI, 2025b), delegate sub-tasks, and exchange artifacts over long horizons (Yao et al., 2023; Schick et al., 2023; Wang et al., 2024a; Wu et al., 2024; Yang et al., 2024; Wang et al., 2024b). The system-level behavior of these stacks is best characterized by the workflows they realize, which are ordered, dependency-rich execution structures over planning steps, tool calls, inter-agent messages, and system events, together with the temporal and causal links that determine how each step shapes the rest of the execution. This shift from single-call inference to long-horizon agentic execution introduces a qualitatively new risk surface that subsumes both unintentional failures and adversarial threats under a single operational concern. The threats we observe on this surface come from two complementary sources. Intrinsic workflow failures arise from the system itself, including flawed planning, ambiguous user instructions, hallucinated intermediates, and breakdowns in tool use or coordination (Zhou et al., 2025; Debenedetti et al., 2025; Li et al., 2025b; Yu et al., 2026). Adversarial workflow manipulations arise from intentional interference such as prompt injection, tool-description injection, privilege escalation, or laundering of malicious intent across multiple agents (Shi et al., 2026; Debenedetti et al., 2024; Zhan et al., 2024; Ma et al., 2025; He et al., 2025). Despite these very different origins, both classes typically begin from a single perturbed step, such as a benign-yet-erroneous user request, a flawed plan, or a misjudged observation on one side, or a malicious instruction or tampered tool description on the other. Once such a step is produced, the workflow keeps consuming and propagating it: downstream agents condition on it, tools receive it, and later decisions are made on top of it, so the original perturbation is amplified across the rest of the execution. As a result, both surface as abnormal execution trajectories that diverge from intended task behavior (Figure 1). Figure 1. Agentic AI execution workflows under normal and abnormal conditions. (a) Benign workflow with coherent planning, tool use, and execution. (b) Adversarial manipulation, where injected steps redirect execution. (c) Intrinsic failure, where non-adversarial errors (e.g., misjudged progress, retries) accumulate.Three side-by-side agentic AI execution workflows drawn as directed graphs: a benign workflow, an adversarially manipulated workflow with injected steps, and an intrinsically failing workflow with accumulated errors. Existing approaches mitigate this risk by attaching defenses to specific layers of the agentic stack. One line restricts how agents handle untrusted inputs (Debenedetti et al., 2025), enforces execution-time invariants (Wang et al., 2025a), or applies transactional protocols where formal specifications are available (Li et al., 2025b). Another line contains compromised components through sandboxing (Wu et al., 2025), mediated tool access (Li et al., 2026a), and rule-based action verification (Chen et al., 2025). A third line matches execution traces against patterns associated with known attack and failure classes (Liu et al., 2025; Li et al., 2025a; Zhou et al., 2025). Each of these is anchored to a specific class of problems or operates at the granularity of an individual prompt, action, or trace fragment, leaving the global dependency structure of a workflow only indirectly examined. As production agentic systems continuously add new tools, agents, and task domains, this leaves a long tail of cross-step anomalies that no single specification or pattern catches. An important research question raised by this gap is therefore: at what granularity should anomalies in agentic AI be detected? Network intrusion detection went through the same transition. Early packet-based detectors flagged each packet in isolation and missed attacks that only became visible across a long session, which motivated record-based intrusion detection that aggregates packets into flows and reasons about them as a whole. Agentic AI is in the same position. Inspecting a single prompt, action, or trace fragment throws away the dependency structure that an injected or flawed step uses to spread, and the most informative signals are non-local, including role-inconsistent delegations, atypical tool-call pathways, and abnormal artifact-to-agent influence. A monitor for agentic AI must therefore reason over whole workflows, model both their semantics and their dependency structure, and remain agnostic to which particular attack or failure mode is in play. We realize this view in Skynet, a principled workflow-level anomaly detection framework for agentic AI. Skynet plugs into the observation layer of modern agentic runtimes by consuming the structured execution records they already expose, and consolidates them into a directed workflow graph that captures planning, tool invocations, inter-agent delegation, data flow, and system events with their temporal and causal dependencies. On top of this representation, Skynet learns from benign workflows alone, jointly modeling what happens (semantic execution context) and how effects propagate (dependency structure), with training views built around the structural regularities of benign agentic execution rather than from random graph perturbation. The detector is therefore aligned with the benign workflow manifold, and exposes both threat classes as off-manifold geometry under a single decision rule. Because training never sees attacks or failures, this design naturally extends to zero-day detection: previously unseen attacks and novel failure modes that violate benign workflow regularities surface through the same off-manifold geometry, with no need to anticipate them. We evaluate Skynet on three public agentic benchmarks targeting complementary failure regimes: Agent-SafetyBench (Zhang et al., 2024) (adversarial manipulations), AgentErrorBench (Zhu et al., 2025) (intrinsic execution failures), and ATBench (Li et al., 2026b) (broad safety-in-the-wild). Training uses only benign trajectories from ETO (Song et al., 2024) and never observes adversarial or failing workflows. 2. System Model, Threat Model, and Problem 2.1. System Model Target agentic AI systems. We target modern multi-agent AI systems that execute complex user intents through structured, long-horizon task execution: orchestrator–worker architectures (Anthropic, 2024a), conversational multi-agent frameworks such as Microsoft AutoGen (Wu et al., 2024) and OpenAI’s ChatGPT Agent (OpenAI, 2025a), agent-to-agent interoperable ecosystems built on Google’s A2A protocol (Google Developers Blog, 2025), and ReAct-style planners (Yao et al., 2023; Wang et al., 2024a) that invoke tools through the Model Context Protocol (MCP) (Anthropic, 2024b; OpenAI, 2025b). A common pattern recurs across these stacks: a planner (or orchestrator) agent decomposes a user task into subtasks, delegates them to specialized worker agents, and composes intermediate results through tool calls and inter-agent messages. The planner naturally acts as an observer of the execution it initiates, since the runtime already exposes structured traces of what each agent did, in what order, with which tools, and with what intermediate results. Skynet plugs directly into this observation layer as a passive consumer of execution records that already exist for telemetry, debugging, and compliance; it does not modify agent logic, tool backends, inter-agent protocols, or LLM weights. Observed execution records. Our system model focuses on observed execution workflows rather than the internal planning states of individual agents. We assume access to four classes of records standard across modern agentic platforms: (i) planning and reasoning traces (ReAct-style thought/action/observation tuples, orchestrator plans, intermediate scratchpads); (i) tool invocations (MCP-style calls with typed inputs/outputs, calling agent identity, status); (i) inter-agent messages through protocols such as A2A or AutoGen’s conversation primitives, including delegation requests, replies, and shared artifacts; and (iv) system-level events (retries, errors, sandbox decisions, timeouts). When a planner delegates a task, it monitors the resulting execution and collects these records within its visibility scope; nested delegations record evidence locally and return it on completion, so workflow evidence is propagated bottom-up and consolidated at the root planner. Workflow construction. Given the consolidated record of an execution, Skynet builds a directed workflow graph (Sec. 3) in a runtime-agnostic way. Nodes correspond to observed execution steps annotated with structured attributes that summarize what the step was, including actor role, action type, tool/endpoint identifier, and status. Typed edges capture how steps relate: temporal precedence, delegation between agents, data-flow dependencies, and cross-agent communication. This construction is intentionally protocol-agnostic and treats platform-specific record formats as instantiations of the same abstraction; for example, an AutoGen conversation, an A2A-mediated interaction, a ChatGPT Agent trace, or a general MCP-tool workflow each yields a graph populated under the same node and edge schema once the corresponding records are parsed through a thin adapter. As a result, a detector trained on one deployment can be reused across heterogeneous agentic systems without retraining on platform-specific schemas, and the framework can be extended to additional runtimes by supplying a new adapter rather than redesigning the representation. Trust boundary. We assume that workflow measurements collected within an organizational trust boundary are trustworthy, supported by standard system-security mechanisms on the host infrastructure. When execution is delegated to external services or agents outside this boundary, we assume the availability of remote attestation mechanisms for exchanging verifiable workflow-level evidence (Zhang et al., 2021; Wang et al., 2023; Ammar et al., 2024; Ammar et al., 2025). The design of secure measurement and attestation infrastructures is orthogonal to our contribution. 2.2. Threat Model Adversary capabilities and limitations. We consider adversaries operating within the trusted measurement boundary. An adversary may exploit vulnerabilities in legitimate agents, inject malicious prompts directly through user-facing channels or indirectly through retrieved documents, tool outputs, or shared artifacts, manipulate intermediate execution context that downstream agents consume, or abuse the legitimate tool-call interface of compromised or coerced agents to steer downstream execution. Crucially, a sophisticated adversary may launder malicious intent across multiple agents so that each individual step looks acceptable in isolation (Ma et al., 2025; He et al., 2025). The adversary cannot, however, forge agent identities at the runtime layer, compromise the integrity of workflow measurements, or directly tamper with the detector itself; these guarantees are inherited from standard system-security mechanisms and from remote attestation across organizational boundaries. Anomalies in scope. Within this trust boundary, we consider two classes of anomalies that both manifest as abnormal workflow execution. Adversarial workflow violations arise from intentional manipulations such as prompt injection, tool-description injection, privilege escalation, tool misuse, or coordinated multi-agent compromise. Intrinsic workflow failures arise from the system itself, including hallucinated intermediates, flawed planning, ambiguous instructions, coordination breakdowns, runaway retries, and other forms of execution instability. Although their root causes differ, both yield workflows that diverge from the structural and semantic regularities of benign execution; Skynet is designed to detect both under a single decision rule. We further assume that a representative corpus of benign executions is available at training time; the corpus need not be exhaustive, and previously unseen anomalies and zero-day attacks need not appear in any form during training. 2.3. Problem Definition Consider an agentic AI system of the form described in Sec. 2.1. For every user request, the system produces an execution that is recorded, through the workflow construction of Sec. 2.1, as a directed attribute graph =(,ℰ,)G=(V,E,X), where V is the set of observed execution steps (planning actions, tool invocations, inter-agent messages, system events), ℰ⊆×E ×V is the set of directed dependency edges whose direction encodes both temporal ordering and causal precedence (temporal sequencing, delegation, data flow, and cross-agent communication), and X collects the node- and edge-level attributes that summarize each step’s actor role, action category, invoked tool/endpoint, and execution status, together with edge interaction semantics. Let allG_all denote the space of all such graphs producible by the system. Each executed workflow is modeled as a sample from one of two unknown distributions over allG_all: a benign distribution ℙbP_b governing workflows that realize intended task behavior, and an anomalous distribution ℙaP_a governing workflows affected by the adversarial manipulations and intrinsic failures of Sec. 2.2. At training time, only ℙbP_b is observable, through a finite corpus b=ii=1N∼iidℙbD_b=\G_i\_i=1^N P_b of measured benign workflows; no labeled anomalies are available. Workflow-level anomaly detection. Given bD_b and a false-positive budget ϵ∈(0,1)ε∈(0,1), the goal is to learn a graph-level scoring function S:all→ℝ≥0S:G_all _≥ 0 and a threshold η∈ℝ≥0η _≥ 0 that induce the decision rule δη()=[S()>η] _η(G)=1[\,S(G)>η\,], flagging G as anomalous when its score exceeds η. We formulate the design problem as (1) minS∈,η≥0ℙ∼ℙa[S()≤η]s.t.ℙ∼ℙb[S()>η]≤ϵ, _S ,\,η≥ 0\;P_G _a\! [\,S(G)≤η\, ] .t. _G _b\! [\,S(G)>η\, ]\;≤\;ε, where S is a hypothesis class of scoring functions trainable from bD_b without anomaly labels. Because ℙbP_b is accessible only through bD_b, the false-positive constraint in (1) is enforced empirically by calibrating η as a high quantile of the benign-score distribution S(i)i=1N\S(G_i)\_i=1^N at level q=1−ϵq=1-ε. The unit of decision is the entire workflow G rather than any individual step or message, so the problem is intrinsically graph-level: S must reflect non-local regularities of benign agentic execution that span multiple steps and multiple agents. The instantiation of S, the construction of S, and the calibration of η that realize (1) are detailed in Sec. 3. 3. The Skynet Framework Figure 2. Overview of Skynet. Skynet constructs a workflow graph from an observed agentic AI execution, learns benign workflow representations from semantic and structural signals, and detects anomalies by measuring how far a new workflow deviates from learned benign patterns.Pipeline diagram of Skynet with three stages: workflow graph construction from an observed agentic execution, dual semantic and structural encoding trained on benign workflows, and anomaly scoring by distance to the nearest benign mode anchor. 3.1. Overview and Design Rationale Skynet realizes the workflow-level scoring function S, the threshold η, and the hypothesis class S sought in problem (1) as an end-to-end pipeline that consumes the workflow graph =(,ℰ,)G=(V,E,X) defined in Sec. 2.3 and produces a single graph-level decision rule. The pipeline is designed as a principled composition rather than a one-off model: every stage is anchored to a property of agentic AI execution, so the detector is benign-only by construction, graph-level by construction, and class-agnostic with respect to whether the underlying anomaly is intrinsic or adversarial. Training pipeline (Figure 2) consists of four stages applied to the benign workflow corpus b=ii=1ND_b=\G_i\_i=1^N. Stage T1: workflow-aware view construction (Sec. 3.2) expands each benign anchor iG_i into an invariant-preserving positive view i+G_i^+ and a set of counterfactual invariant-violating negative views i−G_i^-; both are grown from the structural regularities of benign agentic execution rather than from random graph perturbations, which is what allows the resulting training signal to live near the boundary of benign behavior instead of drifting off into trivially separable noise. Stage T2: dual-branch encoding (Sec. 3.3) maps each workflow through a semantic encoder fθf_θ that summarizes execution context and a structural encoder gϕg_φ that summarizes dependency organization, separating what happens from how effects propagate so that anomalies hiding on either channel remain visible. Stage T3: workflow-aware contrastive learning jointly trains fθf_θ and gϕg_φ to pull each anchor toward its invariant-preserving partner and push it away from its counterfactual under a single workflow-level objective derived from agentic workflow invariants. Stage T4: benign-mode calibration (Sec. 3.4) consolidates the learned joint embeddings of bD_b into a bank of K benign execution modes ckk=1K\c_k\_k=1^K and sets the threshold η to the q-quantile of benign training scores with q=1−ϵq=1-ε, exactly matching the false-positive constraint in (1) without exposure to anomaly labels. Inference pipeline (Figure 2, bottom) takes a new workflow G through the same graph construction and dual-branch encoding, scores it as S()=mink‖z()−ck‖22S(G)= _k\|z(G)-c_k\|_2^2 in the joint embedding space, and flags it whenever S()>ηS(G)>η. The same single rule covers adversarial manipulations, intrinsic failures, and previously unseen anomalies, since every off-manifold workflow surfaces under the same distance, and the procedure runs in two deployment regimes: a per-workflow trailing monitor that scores completed executions, and an incremental per-step monitor that re-scores in-flight executions on every newly observed step. Algorithm 1 consolidates the full procedure. Design rationale. Three properties of agentic AI execution justify the choices above. (O1) Dual-channel manifestation. Agentic anomalies manifest on two distinct channels: many adversarial manipulations preserve the surface vocabulary of agent actions while reshaping dependency flow, and many intrinsic failures preserve the dependency skeleton while corrupting the semantics of intermediate steps; a single representation collapses these channels and misses whichever class hides on the channel it underweights, motivating the dual semantic–structural branches in T2. (O2) Label-free benign manifold. Anomaly labels are scarce, inconsistent across deployments, and inherit the blind spots of whichever threat catalog produced them, so the training signal is grown from benign workflows alone, with positives and negatives generated from agentic workflow invariants rather than the random graph augmentations of generic graph contrastive learning, which drift off the benign manifold and yield trivially separable negatives. (O3) Multimodal benign behavior. Benign agentic behavior is intrinsically heterogeneous (orchestrator pipelines, ReAct loops, deep-research workflows, and multi-agent debates are all benign yet follow qualitatively different normal regimes), so normality is represented as a set of benign execution modes rather than a single reference, preventing legitimate but atypical workflows from being conflated with anomalies. 3.2. Workflow-Aware View Construction The cornerstone of Skynet’s benign-only learning is a pair of view-construction operators +:all→allT^+:G_all _all and −:all→2allT^-:G_all→ 2^G_all, which, for every benign anchor i∈bG_i _b, produce a positive view i+=+(i)G_i^+=T^+(G_i) and a finite set of counterfactual negative views i−=−(i)G_i^-=T^-(G_i). In contrast to the random graph augmentations used in conventional contrastive learning, +T^+ and −T^- are parameterized by workflow invariants, that is, properties that benign agentic executions consistently exhibit and that known agentic anomaly classes are known to perturb. Workflow invariants. We identify four such invariants. (i) Role consistency: agent responsibilities and delegation patterns remain compatible with their intended functions. (i) Provenance and trust consistency: outputs consumed by later steps originate from expected sources, and benign workflows do not silently elevate the influence of low-trust artifacts on high-stakes downstream actions. (i) Dependency and coordination consistency: prerequisite relations, hand-off structure, and information flow remain coherent, with delegation closing properly and inter-agent coordination converging. (iv) Stability: executions remain bounded and avoid uncontrolled retries, loops, or oscillatory propagation. Each invariant is empirically associated with one or more known anomaly families: prompt injection commonly violates role and provenance consistency (Debenedetti et al., 2024; Zhan et al., 2024); coordination breakdowns and intrinsic planning failures violate dependency consistency (Zhou et al., 2025); runaway retries and progress-misjudgment failures violate stability (Zhu et al., 2025). Anchoring view construction on these invariants is what makes Skynet workflow-aware rather than a generic graph learner, and what gives the resulting training signal a semantic interpretation grounded in the agentic-AI threat surface. Invariant-preserving views (positives). The positive operator +T^+ maps iG_i to a view i+G_i^+ that respects all four invariants while exposing the natural variability of benign agentic execution. We instantiate +T^+ as a stochastic composition of three families of transformations: (i) observation-preserving rewrites retain the dependency structure while masking or perturbing non-essential observation content (e.g., paraphrasing free-form notes, redacting irrelevant tool fields); (i) execution-equivalent rewrites apply local edits that preserve task semantics, such as reordering independent operations or substituting semantically equivalent tool/action attributes; and (i) prefix or partial rewrites expose incomplete yet still valid sub-workflows, reflecting the partial observability faced by an in-flight monitor. By construction i+G_i^+ remains in supp(ℙb)supp(P_b) and is therefore a semantically faithful positive: pulling iG_i and i+G_i^+ together in representation space teaches the encoders to be invariant to the natural variability of benign agentic execution rather than to arbitrary graph noise. Counterfactual invariant-violating views (negatives). The negative operator −T^- is the design move that distinguishes Skynet’s contrastive scheme from generic graph contrastive learning. For each benign anchor iG_i and invariant I∈Role,Prov,Dep,StabI∈\ Role, Prov, Dep, Stab\, an invariant-specific operator I−T^-_I produces a counterfactual i−,IG_i^-,I that minimally violates I while leaving the remaining three invariants intact. Concretely, role counterfactuals reassign or relabel an agent’s action so that a delegation crosses a benign role boundary; provenance counterfactuals reroute one downstream consumption to draw from a non-canonical source; dependency counterfactuals delete or insert a single hand-off edge so that a sub-workflow no longer closes properly; stability counterfactuals extend a retry or loop tail beyond benign envelopes. Each i−,IG_i^-,I obeys three principles by design: minimal modification (smallest perturbation sufficient to violate the targeted invariant), single-invariant violation (the training signal isolates one axis of agentic anomaly), and local plausibility (the perturbed workflow could plausibly arise in real agentic execution). The full negative set i−=⋃Ii−,IG_i^-\;=\; _I\, \G_i^-,I \. Therefore, it carves out the boundary of supp(ℙb)supp(P_b) along agentic-meaningful directions, in contrast to random edge or attribute perturbations whose negatives drift far outside supp(ℙb)supp(P_b) and are trivially separable. The ablation in Sec. 4.3 confirms that replacing −T^- with random graph augmentation collapses recall on near-manifold attacks and intrinsic failures even when the rest of the pipeline is held fixed. 3.3. Dual-Branch Workflow Representation Learning Two-branch encoder. Given a workflow graph G, Skynet computes two embeddings, h()=fθ()∈ℝdhh(G)=f_θ(G) ^d_h and t()=gϕ()∈ℝdtt(G)=g_φ(G) ^d_t, where the semantic encoder fθf_θ is a message-passing graph encoder that consumes node and edge attributes (actor role, action category, tool/endpoint, status, edge type), and the structural encoder gϕg_φ is a message-passing graph encoder that consumes the structural descriptors of each node (degree statistics, distances to workflow boundaries, ancestor/descendant relations, and influence-concentration scores). The two branches do not share parameters; this decoupling is intentional and reflects observation (O1): agentic anomalies frequently perturb only one of the two channels, and parameter sharing would force a single representation to compromise between them. Per-anchor contrast pool. Let ℬ⊆bB _b be a mini-batch of size B. For each anchor i∈ℬG_i , we instantiate i+=+(i)G_i^+=T^+(G_i) and i−=−(i)G_i^-=T^-(G_i) on the fly and define the per-anchor contrast pool i=j+:j∈ℬ,j≠i∪i−Q_i=\G_j^+:j ,\,j≠ i\ _i^-, which combines in-batch benign negatives with same-anchor counterfactual negatives. The two sources are complementary: in-batch benign negatives spread different benign workflows across the embedding space and prevent representation collapse, while same-anchor counterfactual negatives sharpen the decision surface along the agentic-invariant directions that downstream anomalies actually perturb. Dual contrastive objective. Let sim(u,v)=u⊤v/(‖u‖‖v‖)sim(u,v)=u v/(\|u\|\,\|v\|) denote cosine similarity and τ>0τ>0 a temperature. The semantic and structural branches are trained under analogous standard contrastive objectives, (2) Lsem(θ) L_sem(θ) =−1B∑i=1Blogexp(sim(hi,hi+)/τ)∑∈i+∪iexp(sim(hi,h())/τ), \;=\;-\, 1B _i=1^B (sim(h_i,\,h_i^+)/τ ) _G∈\G_i^+\ _i\!\! (sim(h_i,\,h(G))/τ ), (3) Lstr(ϕ) L_str(φ) =−1B∑i=1Blogexp(sim(ti,ti+)/τ)∑∈i+∪iexp(sim(ti,t())/τ), \;=\;-\, 1B _i=1^B (sim(t_i,\,t_i^+)/τ ) _G∈\G_i^+\ _i\!\! (sim(t_i,\,t(G))/τ ), where hi=h(i)h_i=h(G_i), hi+=h(i+)h_i^+=h(G_i^+), and ti,ti+t_i,t_i^+ are defined analogously. The two branches are combined into the workflow-level training objective (4) L(θ,ϕ)=αLsem(θ)+βLstr(ϕ),α,β>0,L(θ,φ)\;=\;α\,L_sem(θ)\;+\;β\,L_str(φ), α,β>0, which is minimized by stochastic gradient descent over the two encoders’ parameters. Intuitively, LsemL_sem teaches fθf_θ that two workflows with the same task semantics but different surface presentation should embed close, and that a workflow whose role, provenance, dependency, or stability invariant has been minimally violated should embed far; LstrL_str enforces the analogous property in the structural channel. Concretely, the gradient of LsemL_sem with respect to hih_i is a softmax-weighted sum that pulls hih_i toward hi+h_i^+ and pushes it away from each h()h(G) for ∈iG _i, with the strongest repulsion applied to whichever counterfactual currently sits closest to the anchor in representation space; the same dynamics hold for LstrL_str in the structural channel. Through the standard mutual-information lower-bound interpretation of contrastive learning, minimizing (2)–(3) maximizes a tractable lower bound on I(h(),h(+))I (h(G);\,h(G^+) ) and I(t(),t(+))I (t(G);\,t(G^+) ), so the encoders retain exactly the information that is invariant under the benign view operator +T^+ and discard the information that the counterfactual operator −T^- shows is not invariant under benign behavior. The novelty of (4) therefore lies not in the contrastive form itself but in what it contrasts: invariant-preserving and invariant-violating views, applied along a dual semantic–structural decomposition that mirrors the two channels through which agentic anomalies manifest. Hypothesis class. The hypothesis class S from problem (1) is therefore realized as =↦mink∥zθ,ϕ()−ck∥22∣(θ,ϕ)∈Θ,ckk=1K⊂ℝdh+dtS=\\,G _k\|z_θ,φ(G)-c_k\|_2^2 (θ,φ)∈ ,\;\c_k\_k=1^K ^d_h+d_t\,\, with zθ,ϕ()=[h();λt()]z_θ,φ(G)=[\,h(G)\,;\, λ\,t(G)\,]. The encoder parameters (θ,ϕ)(θ,φ) are fit by minimizing (4); the mode anchors ck\c_k\ and threshold η are fit subsequently on bD_b alone, as described next. 3.4. Workflow-Mode Anomaly Scoring After training, Skynet forms the joint workflow representation z()=[h();λt()]∈ℝdh+dtz(G)=[\,h(G)\,;\, λ\,t(G)\,] ^d_h+d_t, with λ>0λ>0 rescaling the structural branch. To respect the heterogeneity of benign agentic execution (O3), normality is modeled as a set of K benign execution modes ckk=1K\c_k\_k=1^K obtained by k-means on z(i)i=1N\z(G_i)\_i=1^N, where each mode corresponds to a recurrent pattern of nominal behavior such as a coordination style, a tool-usage regime, or a task-decomposition structure. The graph-level anomaly score S in problem (1) is then instantiated as the squared distance to the nearest benign mode, S()=min1≤k≤K‖z()−ck‖22,S(G)\;=\; _1≤ k≤ K\, \|z(G)-c_k \|_2^2, and the threshold η is calibrated as the empirical q-quantile of S(i)i=1N\S(G_i)\_i=1^N with q=1−ϵq=1-ε, exactly enforcing the false-positive constraint of (1) on bD_b. A test workflow is flagged when S()>ηS(G)>η. Because S measures distance to the benign manifold rather than similarity to any specific anomaly family, the same single decision rule covers adversarial manipulations, intrinsic failures, and previously unseen anomalies: any workflow that fits none of the benign modes surfaces as off-manifold geometry under S. The end-to-end procedure is summarized in Algorithm 1. Algorithm 1 Skynet: benign-only workflow-level anomaly detection. 0: Benign workflow-graph corpus b=ii=1ND_b=\G_i\_i=1^N; semantic encoder fθf_θ; structural encoder gϕg_φ; loss weights α,βα,β; structural scale λ; temperature τ; benign-mode count K; calibration quantile q; training epochs E; batch size B. 0: Trained encoders (fθ,gϕ)(f_θ,g_φ); benign-mode bank ckk=1K\c_k\_k=1^K; detection threshold η; anomaly scorer S(⋅)S(·). 1: Initialize θ,ϕθ,φ. 2: for epoch=1epoch=1 to E do 3: Sample a mini-batch ℬ⊂bB _b of size B. 4: For each i∈ℬG_i , generate an invariant-preserving view i+G_i^+ and a set of counterfactual views i−G_i^- that each minimally violate one role, provenance, dependency, or stability invariant. 5: Form the per-anchor contrast pool i←j+j≠i∪i−Q_i←\G_j^+\_j≠ i _i^-. 6: Compute hi,hi+,ti,ti+h_i,h_i^+,t_i,t_i^+ for i,i+G_i,G_i^+ and h(),t()h(G),t(G) for all ∈iG _i. 7: Lsem←−1B∑ilogexp(sim(hi,hi+)/τ)∑∈i+∪iexp(sim(hi,h())/τ)L_sem←- 1B _i (sim(h_i,h_i^+)/τ) _G∈\G_i^+\ _i (sim(h_i,h(G))/τ). 8: Lstr←−1B∑ilogexp(sim(ti,ti+)/τ)∑∈i+∪iexp(sim(ti,t())/τ)L_str←- 1B _i (sim(t_i,t_i^+)/τ) _G∈\G_i^+\ _i (sim(t_i,t(G))/τ). 9: L←αLsem+βLstrL←α L_sem+β L_str; update θ,ϕθ,φ by one optimizer step on L. 10: end for 11: Compute z(i)=[h(i);λt(i)]i=1N\z(G_i)=[h(G_i); λ\,t(G_i)]\_i=1^N and fit K benign-mode anchors ckk=1K\c_k\_k=1^K by k-means in the joint embedding space. 12: Define S()←mink‖z()−ck‖22S(G)← _k\|z(G)-c_k\|_2^2; set η to the q-quantile of S(i)i=1N\S(G_i)\_i=1^N. 13: At inference, given a (possibly in-flight) test workflow prefix G: 14: compute z()=[fθ();λgϕ()]z(G)=[f_θ(G); λ\,g_φ(G)] and s←S()s← S(G). 15: if s>ηs>η then flag G as anomalous else accept as benign. 16: The same procedure is applied either once on the completed workflow (trailing per-workflow mode) or after each newly observed step on the current prefix (incremental per-step mode). 17: return (fθ,gϕ,ck,η,S)(f_θ,g_φ,\c_k\,η,S). 4. Evaluation We evaluate Skynet as an always-on workflow-level anomaly detector around three questions. RQ1. Does it detect workflow-level anomalies across both adversarial manipulations and intrinsic failures while sustaining a deployment-relevant low-FPR operating point (Sec. 4.2)? RQ2. Does each workflow-aware learning component deliver the operating-point gain it is designed for (Sec. 4.3)? RQ3. Is its runtime overhead compatible with always-on monitoring (Sec. 4.4)? 4.1. Evaluation Setup Benchmarks. For adversarial evaluation we use Agent-SafetyBench (Zhang et al., 2024) (111111 trajectories from safety red-teaming) and ATBench (Li et al., 2026b) (497497 trajectories across eight risk sources and fourteen failure modes); for intrinsic failures we use AgentErrorBench (Zhu et al., 2025) (200200 non-adversarial trajectories across AlfWorld, GAIA, and WebShop). A Combined scenario aggregates all 808808 anomalies with the benign test set to measure cross-source robustness when the anomaly distribution broadens. Benign trajectories come from ETO (Song et al., 2024) on AlfWorld (Shridhar et al., 2021), SciWorld (Wang et al., 2022), and WebShop (Yao et al., 2022), converted to workflow graphs (Sec. 3) and partitioned into 4,4944,494/562562/562562 train/validation/test splits; anomalies are never seen during training. The three anomaly benchmarks are public datasets independently released by different groups; using them together avoids co-design bias between training and evaluation. Baselines. We compare against six detectors covering the current design space: agent-centric textual monitoring (GuardAgent (Xiang et al., 2025)); provenance-level defenses (TraceAegis (Liu et al., 2025), Guardian (Zhou et al., 2025)); and graph anomaly detectors (F-GAE (Feng et al., 2022), CoLA (Liu et al., 2022), TopoGCL(Chen et al., 2024)). All baselines share the same graph inputs and benign training split, each tuning its own threshold via a balance-oriented validation rule. To prevent trivial detection via surface features, graph baselines are stripped of text- and length-based shortcuts: raw text content is removed from node attributes and only categorical/numerical workflow features (role, action type, tool, status, structural descriptors) are retained, and per-graph node/edge counts are normalized so that graph-size cues alone cannot drive the score. Implementation and metrics. We set structural scale λ=1.2λ=1.2 and combine the semantic and structural objectives with α=0.6α=0.6, β=0.4β=0.4. Normality is modeled by a benign-only k-means bank with K=150K=150 modes, and the threshold is calibrated on benign training scores at a quantile that targets a sub-1%1\% benign false-positive budget, yielding a single fixed operating point that materializes to ≈0.89%≈ 0.89\% FPR on the held-out benign test split. We report accuracy, precision, recall, F1, and FPR; FPR is the deployment-critical metric, since any always-on monitor firing above a few percent FPR is unusable in production. ROC curves provide a threshold-independent view that controls for the asymmetry between Skynet’s fixed-quantile calibration and the per-method balance-oriented thresholds used by the baselines. 4.2. Detection Effectiveness (RQ1) Figure 3. UMAP projection of the learned joint workflow embedding z()z(G). Top-row panels overlay anomalies from each benchmark on the held-out benign test set; the bottom panel shows all three benchmarks together with the K=150K=150 benign mode anchors. Benign workflows form a coherent manifold around the anchors; anomalies from each source consistently lie off-manifold.UMAP scatter plots of workflow embeddings. Benign workflows cluster tightly around the benign mode anchors, while anomalous workflows from each benchmark scatter away from that cluster. Embedding-space geometry. Figure 3 qualitatively illustrates how Skynet reshapes the workflow space: benign workflows concentrate in a coherent manifold around the mode anchors, while anomalies from every benchmark lie off-manifold regardless of which threat class produced them. This is the geometry the multi-mode detector exploits. UMAP is nonlinear and stochastic, so the 2D view is illustrative; all detection scores below are computed in the original joint embedding. Agent-SafetyBench AgentErrorBench ATBench Combined Method Acc Prec Rec F1 FPR Acc Prec Rec F1 FPR Acc Prec Rec F1 FPR Acc Prec Rec F1 FPR Skynet 99.26 95.69 100.00 97.80 0.89 99.34 97.56 100.00 98.77 0.89 91.41 98.80 82.70 90.03 0.89 93.36 99.31 89.36 94.07 0.89 F-GAE 97.86 90.91 99.10 94.83 2.14 98.05 93.02 98.50 95.68 2.14 88.94 90.12 84.31 87.12 2.14 90.87 93.44 86.92 90.06 2.14 TraceAegis 96.62 86.89 96.40 91.40 3.38 96.83 89.19 94.50 91.77 3.38 67.43 61.54 34.61 44.27 3.38 75.92 78.48 58.42 66.98 3.38 Guardian 99.85 99.11 100.00 99.55 0.18 99.87 99.50 100.00 99.75 0.18 61.57 98.91 18.31 30.90 0.18 70.29 99.75 49.75 66.39 0.18 TopoGCL 95.69 80.15 98.20 88.26 4.80 92.78 86.43 86.00 86.22 4.80 56.56 70.33 12.88 21.77 4.80 64.23 92.74 42.70 58.47 4.80 CoLA 95.10 77.08 100.00 87.06 5.87 71.26 29.79 7.00 11.34 5.87 73.56 88.34 50.30 64.10 5.87 65.99 91.91 46.41 61.68 5.87 GuardAgent 84.10 64.29 8.11 14.40 0.89 73.10 0.00 0.00 0.00 0.89 60.25 94.19 16.30 27.79 0.89 47.23 94.74 11.14 19.93 0.89 Table 1. Detection performance across the four evaluation scenarios (all values in %). Figure 4. ROC curves of Skynet and the six baselines across the four evaluation scenarios. Skynet dominates the deployment-relevant low-FPR region across all four scenarios; baselines that are near-perfect on Agent-SafetyBench and AgentErrorBench degrade sharply on ATBench and Combined.Four ROC plots, one per evaluation scenario, comparing Skynet against six baselines. The Skynet curve rises fastest in the low false-positive-rate region of every panel. Cross-scenario detection. Table 1 and Figure 4 show that Skynet is the only detector that maintains high recall with sub-1%1\% FPR across all four scenarios at one fixed operating point, as required for online monitoring. It achieves 100%100\% recall at 0.89%0.89\% FPR on Agent-SafetyBench and AgentErrorBench, delivers the best recall–FPR trade-off on ATBench and Combined, and attains the highest F1 on both broader scenarios. The Combined setting most clearly distinguishes workflow-level monitoring from prior approaches. On the focused benchmarks, several baselines also achieve near-saturated recall below 1%1\% FPR (e.g., Guardian matches Skynet’s recall at lower FPR), as coarse trace or coordination shifts are easy for graph monitors to detect. Under broader threat distributions, however, they degrade sharply: Guardian’s recall falls to the tens of percent on ATBench and roughly halves on Combined, while TraceAegis loses most recall on ATBench, indicating poor transfer of coordination- or trace-specific signals. In contrast, Skynet detects off-manifold deviations from benign workflow regularities, allowing it to transfer across heterogeneous adversarial and intrinsic anomalies while preserving both high recall and the sub-1%1\% FPR budget, also reflected in the highest mean F1. The ROC curves confirm this threshold-independently: text-only monitoring is insufficient at workflow scale; trace- and provenance-level defenses perform well on focused sets but degrade under distribution shift; and generic graph anomaly detectors require 22–6%6\% FPR for competitive recall, making them unsuitable for always-on monitoring. Subclass n Acc Prec Rec F1 FPR AgentErrorBench (failure type) inefficient_plan 46 99.18 90.20 100.00 94.85 0.89 over_simplification 20 99.14 80.00 100.00 88.89 0.89 progress_misjudge 20 99.14 80.00 100.00 88.89 0.89 constraint_ignorance 13 99.13 72.22 100.00 83.87 0.89 hallucination 13 99.13 72.22 100.00 83.87 0.89 outcome_misinterpretation 12 99.13 70.59 100.00 82.76 0.89 impossible_action 10 99.13 66.67 100.00 80.00 0.89 step_limit 8 99.12 61.54 100.00 76.19 0.89 environment_error 7 99.12 58.33 100.00 73.68 0.89 misalignment 7 99.12 58.33 100.00 73.68 0.89 causal_misattribution 5 99.12 50.00 100.00 66.67 0.89 parameter_error 4 99.12 44.44 100.00 61.54 0.89 tool_execution_error 4 99.12 44.44 100.00 61.54 0.89 memory_retrieval_failure 2 99.11 28.57 100.00 44.44 0.89 invalid_action 1 99.11 16.67 100.00 28.57 0.89 llm_limit 1 99.11 16.67 100.00 28.57 0.89 unknown 27 99.15 84.38 100.00 91.53 0.89 ATBench (risk source) direct_prompt_injection 39 98.84 88.10 94.87 91.36 0.89 indirect_prompt_injection 77 96.09 91.94 74.03 82.01 0.89 tool_description_injection 52 98.37 90.38 90.38 90.38 0.89 jailbreak 61 97.75 91.23 85.25 88.14 0.89 unreliable_or_misinformation 64 97.28 91.23 81.25 85.95 0.89 corrupted_tool_feedback 44 98.35 88.64 88.64 88.64 0.89 malicious_tool_execution 25 99.15 83.33 100.00 90.91 0.89 inherent_agent_failures 135 94.55 95.33 75.56 84.30 0.89 Table 2. Fine-grained detection performance of Skynet on AgentErrorBench failure types and ATBench risk sources (all values in %). Generality across agentic anomaly regimes. Table 2 breaks down failure types and adversarial behaviors under the same fixed detector. On AgentErrorBench, Skynet achieves full recall across all 1717 intrinsic failure types, including subtle errors such as hallucination, constraint ignorance, and causal misattribution, indicating a broadly discriminative boundary over failures unseen during training. Lower precision on rare categories is largely a sample-size effect: at the fixed 0.89%0.89\% FPR, the ∼ 5 benign false positives among 562562 samples dominate precision when only a few positives are present. On ATBench, recall remains high for overt attacks (e.g., malicious_tool_execution and direct_prompt_injection) but drops for inherent_agent_failures and indirect_prompt_injection, whose executions most closely resemble benign workflows. These cases mark the limit of workflow-level off-manifold detection and motivate complementary content-aware checks. 4.3. Workflow-Aware Learning Scheme: Component Contributions (RQ2) Variant Acc Prec Rec F1 FPR Full Skynet 96.64 99.48 94.80 97.08 0.71 w/o structural branch 94.09 99.32 90.59 94.76 0.89 w/o counterfactual views 94.09 99.19 90.72 94.76 1.07 w/o workflow-aware aug. 95.84 99.30 93.54 96.33 0.98 single-mode inference 79.42 99.25 65.59 78.99 0.71 Table 3. Component-level ablation on the Combined scenario, with one component disabled at a time (all values in %). Table 3 quantifies each component’s contribution on Combined using the same data as Table 1, but from a separate ablation run. We prioritize recall and FPR, using F1 only as a secondary check, since even modest recall loss or a few-percent FPR increase is costly for always-on monitoring. Structural branch. Removing it reduces recall by several points and raises FPR to ∼ 0.9%, with a corresponding F1 drop, showing that dependency-sensitive structure adds information beyond semantics; many agentic failures arise from how effects propagate through a workflow rather than from local step content. Counterfactual invariant-violating views. Removing them increases FPR by roughly 1.5×1.5×, exceeding the 1%1\% budget, while only modestly reducing recall, indicating that they primarily tighten the benign boundary against near-manifold deviations. Multi-mode benign scoring. Collapsing the K=150K=150 benign modes into a single reference is the most damaging ablation: recall drops by roughly one third while FPR remains similar, highlighting both the multimodality of benign workflows and the limitation of single-reference one-class scoring. Workflow-aware view construction. Removing it lowers recall and raises FPR by about 1.4×1.4× beyond the 1%1\% budget, confirming that physically realizable workflow views improve both detection and calibration. Overall, the components are complementary: structural encoding and counterfactual views shape off-manifold geometry, multi-mode scoring captures benign diversity, and workflow-aware views preserve the low-FPR regime required for always-on monitoring. 4.4. Always-On Monitoring Overhead (RQ3) Component Total (s) Mean (s) P95 (s) Per-workflow component cost (offline) Graph construction 0.2249 0.0225 0.0882 Encoder forward (sem. ++ struct.) 0.5816 0.0582 0.1437 Mode scoring (batched) 0.0013 0.0001 — End-to-end per workflow — 0.0808 0.2282 End-to-end scalability by workflow size Small (1212 nodes) — 0.0243 0.0540 Medium (2121–2727 nodes) — 0.0599 0.0681 Large (3030–121121 nodes) — 0.1388 0.3114 Online incremental scoring (per-step latency) Step 11 — 0.0048 0.0079 Step 1010 — 0.0302 0.1237 Step 2020 — 0.1048 0.5727 Step 8080 — 0.0488 0.0769 Table 4. Runtime overhead of Skynet: offline per-workflow cost, scalability with workflow size, and online incremental per-step latency. Table 4 characterizes deployment overhead. Offline per-workflow latency, dominated by graph construction and dual-encoder inference, remains well below one second even for the largest workflows, while mode scoring is negligible. Online per-step latency stays in the tens of milliseconds at early and late prefixes (mean 4.84.8–48.848.8 ms at steps 11 and 8080), rising to roughly 0.10.1 s mean (∼0.57 0.57 s P95) at intermediate steps as graph reconstruction grows, before amortizing downward. Thus, Skynet supports both trailing per-workflow and interactive per-step monitoring without stalling the agent pipeline, meeting the runtime requirements for always-on monitoring at the evaluated scale. 5. Related Work Agentic AI security. Existing safeguards for agentic AI fall into three broad categories. System-level isolation approaches such as IsolateGPT (Wu et al., 2025) and ACE (Li et al., 2026a) decouple execution environments to limit the blast radius of compromised agents. Policy- and analysis-based defenses such as AgentArmor (Wang et al., 2025a), SafeFlow (Li et al., 2025b), and ShieldAgent (Chen et al., 2025) enforce access controls or verify agent actions against predefined safety rules. Runtime monitoring systems such as TraceAegis (Liu et al., 2025), DRIFT (Li et al., 2025a), GUARDIAN (Zhou et al., 2025), and MindGuard (Wang et al., 2025b) analyze execution traces or interaction graphs to flag specific threat or coordination patterns. These mechanisms provide important protections at well-defined layers of the agentic stack, but each typically targets a specific violation type or relies on hand-crafted rules; Skynet is complementary, providing a benign-only, attack-agnostic detection layer that surfaces both adversarial manipulations and inherent failures from observed workflows without relying on attack signatures or behavioral specifications. Graph-based anomaly detection. Graph anomaly detection has been studied extensively in complex systems. Reconstruction-based methods such as F-GAE (Feng et al., 2022) flag structural deviations through autoencoder reconstruction error. Contrastive learning approaches such as CoLA (Liu et al., 2022), AD-GCL (Suresh et al., 2021), and TopoGCL (Chen et al., 2024) learn anomaly-sensitive graph representations from unlabeled data, while system-log defenses such as MAGIC (Jia et al., 2024), SLOT (Qiao et al., 2025), and TRAIL (Deshpande et al., 2025) apply graph learning to advanced persistent threat detection. These methods provide strong generic graph signal but are not tailored to agentic execution semantics; Skynet adapts the contrastive paradigm with workflow-aware invariants and counterfactual hard negatives, and pairs it with multi-prototype inference that respects the multimodal nature of benign agentic workflows. LLM safety and benchmarks. LLM safety research has focused largely on prompt-level vulnerabilities and alignment, including prompt injection attacks (Greshake et al., 2023; Zhan et al., 2024) and defenses based on filtering or robust training (Debenedetti et al., 2025; Jin et al., 2026). Benchmarks such as Agent Security Bench (Zhang et al., 2025), AgentHarm (Andriushchenko et al., 2025), Agent-SafetyBench (Zhang et al., 2024), AgentErrorBench (Zhu et al., 2025), and ATBench (Li et al., 2026b) provide standardized evaluations for diverse agent vulnerabilities and failure modes. We use the latter three as external testbeds for Skynet, spanning explicit adversarial manipulations, non-adversarial execution failures, and broad safety-in-the-wild settings. 6. Conclusion We presented Skynet, a workflow-level anomaly detection framework for agentic AI systems. Integrated into the runtime observation layer, Skynet consolidates multi-agent execution traces into directed workflow graphs capturing semantic context and structural dependencies. Trained only on benign workflows, it models normality as a multi-mode benign manifold and detects adversarial manipulations, intrinsic failures, and zero-day anomalies under a unified decision rule. Across three public agentic benchmarks, Skynet sustains high recall at a sub-1%1\% false positive rate, with per-workflow and per-step latencies suitable for online monitoring. Acknowledgements This work was supported in part by the Office of Naval Research under grant N00014-24-1-2663, N00014-24-1-2730, the National Science Foundation under grants 2154930, 2312447, 2247560, 2332675, 2433904, and 2235232, and the Virginia Commonwealth Cyber Initiative (CCI). References Ammar et al. (2024) M. Ammar, A. Abdelraoof, and S. Vlasceanu On bridging the gap between control flow integrity and attestation schemes. In 33rd USENIX Security Symposium (USENIX Security 24), p. 6633–6650. Cited by: §2.1. Ammar et al. (2025) M. Ammar, A. Caulfield, and I. D. O. Nunes SoK: integrity, attestation, and auditing of program execution. In 2025 IEEE Symposium on Security and Privacy (SP), p. 3255–3272. External Links: Document Cited by: §2.1. Andriushchenko et al. (2025) M. Andriushchenko, A. Souly, M. Dziemian, D. Duenas, M. Lin, J. Wang, D. Hendrycks, A. Zou, Z. Kolter, M. Fredrikson, Y. Gal, and X. Davies AgentHarm: a benchmark for measuring harmfulness of llm agents. In International Conference on Learning Representations, External Links: Link Cited by: §5. Anthropic (2024a) Anthropic Building effective agents. Note: Published December 19, 2024 External Links: Link Cited by: §1, §2.1. Anthropic (2024b) Anthropic Introducing the model context protocol (mcp). Note: Available at: https://w.anthropic.com/news/model-context-protocol (accessed 2026-04-11) Cited by: §1, §2.1. Chen et al. (2024) Y. Chen, J. Frias, and Y. R. Gel TopoGCL: topological graph contrastive learning. In Proceedings of the AAAI conference on artificial intelligence, Vol. 38, p. 11453–11461. Cited by: §4.1, §5. Chen et al. (2025) Z. Chen, M. Kang, and B. Li ShieldAgent: shielding agents via verifiable safety policy reasoning. In Forty-second International Conference on Machine Learning (ICML), Cited by: §1, §5. Debenedetti et al. (2025) E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr Defeating prompt injections by design. arXiv preprint arXiv:2503.18813. Cited by: §1, §1, §5. Debenedetti et al. (2024) E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr Agentdojo: a dynamic environment to evaluate prompt injection attacks and defenses for llm agents. Advances in Neural Information Processing Systems 37, p. 82895–82920. Cited by: §1, §3.2. Deshpande et al. (2025) D. Deshpande, V. Gangal, H. Mehta, J. Krishnan, A. Kannappan, and R. Qian TRAIL: trace reasoning and agentic issue localization. arXiv preprint arXiv:2505.08638. Cited by: §5. Feng et al. (2022) Y. Feng, J. Chen, Z. Liu, H. Lv, and J. Wang Full graph autoencoder for one-class group anomaly detection of iiot system. IEEE Internet of Things Journal 9 (21), p. 21886–21898. Cited by: §4.1, §5. Google Developers Blog (2025) Google Developers Blog Announcing the agent2agent protocol (a2a). Note: https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/Accessed 2026-01 Cited by: §1, §2.1. Greshake et al. (2023) K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz Not what you’ve signed up for: compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM workshop on artificial intelligence and security, p. 79–90. Cited by: §5. He et al. (2025) P. He, Y. Lin, S. Dong, H. Xu, Y. Xing, and H. Liu Red-teaming llm multi-agent systems via communication attacks. In Findings of the Association for Computational Linguistics: ACL 2025, p. 6726–6747. Cited by: §1, §2.2. Jia et al. (2024) Z. Jia, Y. Xiong, Y. Nan, Y. Zhang, J. Zhao, and M. Wen MAGIC: detecting advanced persistent threats via masked graph representation learning. In 33rd USENIX Security Symposium (USENIX Security 24), p. 5197–5214. Cited by: §5. Jin et al. (2026) H. Jin, C. Zhang, H. Yu, S. Shi, N. Zhang, Y. T. Hou, and W. Lou Trusting what you cannot see: auditable Fine-Tuning and inference for proprietary AI. In 35th USENIX Security Symposium (USENIX Security 26), Baltimore, MD. Cited by: §5. Li et al. (2026a) E. Li, T. Mallick, E. Rose, W. Robertson, A. Oprea, and C. Nita-Rotaru ACE: a security architecture for llm-integrated app systems. In Network and Distributed System Security Symposium (NDSS), External Links: Document, Link Cited by: §1, §5. Li et al. (2025a) H. Li, X. Liu, H. Chiu, D. Li, N. Zhang, and C. Xiao DRIFT: dynamic rule-based defense with injection isolation for securing llm agents. Advances in Neural Information Processing Systems. Cited by: §1, §5. Li et al. (2025b) P. Li, X. Zou, Z. Wu, R. Li, S. Xing, H. Zheng, Z. Hu, Y. Wang, H. Li, Q. Yuan, et al. Safeflow: a principled protocol for trustworthy and transactional autonomous agent systems. arXiv preprint arXiv:2506.07564. Cited by: §1, §1, §5. Li et al. (2026b) Y. Li, H. Luo, Y. Xie, Y. Fu, Z. Yang, S. Shao, Q. Ren, W. Qu, Y. Fu, Y. Yang, et al. ATBench: a diverse and realistic agent trajectory benchmark for safety evaluation and diagnosis. arXiv preprint arXiv:2604.02022. External Links: Document, Link Cited by: §1, §4.1, §5. Liu et al. (2025) J. Liu, B. Ruan, X. Yang, Z. Lin, Y. Liu, Y. Wang, T. Wei, and Z. Liang TraceAegis: securing llm-based agents via hierarchical and behavioral anomaly detection. arXiv preprint arXiv:2510.11203. Cited by: §1, §4.1, §5. Liu et al. (2022) Y. Liu, Z. Li, S. Pan, C. Gong, C. Zhou, and G. Karypis Anomaly detection on attributed networks via contrastive self-supervised learning. IEEE Transactions on Neural Networks and Learning Systems 33 (6), p. 2378–2392. Cited by: §4.1, §5. Ma et al. (2025) X. Ma, Y. Gao, Y. Wang, R. Wang, X. Wang, Y. Sun, Y. Ding, H. Xu, Y. Chen, Y. Zhao, et al. Safety at scale: a comprehensive survey of large model and agent safety. Foundations and Trends in Privacy and Security 8 (3-4), p. 254–469. External Links: Document, Link Cited by: §1, §2.2. OpenAI (2025a) OpenAI Introducing chatgpt agent. Note: https://openai.com/index/introducing-chatgpt-agent/Technical blog describing OpenAI’s agentic extension of ChatGPT with autonomous planning and tool use Cited by: §1, §2.1. OpenAI (2025b) OpenAI Model context protocol – openai agents python documentation. Note: Available at: https://openai.github.io/openai-agents-python/mcp/ (accessed 2026-04-11) Cited by: §1, §2.1. Qiao et al. (2025) W. Qiao, Y. Feng, T. Li, Z. Ma, Y. Shen, J. Ma, and Y. Liu Slot: provenance-driven apt detection through graph reinforcement learning. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, p. 963–977. Cited by: §5. Schick et al. (2023) T. Schick, J. Dwivedi-Yu, R. Dessì, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom Toolformer: language models can teach themselves to use tools. Advances in Neural Information Processing Systems 36, p. 68539–68551. Cited by: §1. Shi et al. (2026) S. Shi, X. Wang, C. Zhang, H. Li, W. Lou, Y. T. Hou, Y. Vorobeychik, C. Zhang, and N. Zhang Think twice before you act: protecting LLM agents against tool description poisoning via isolated planning. In Proceedings of the 43rd International Conference on Machine Learning, Cited by: §1. Shridhar et al. (2021) M. Shridhar, X. Yuan, M. Cote, Y. Bisk, A. Trischler, and M. Hausknecht ALFWorld: aligning text and embodied environments for interactive learning. In International Conference on Learning Representations (ICLR), Cited by: §4.1. Song et al. (2024) Y. Song, D. Yin, X. Yue, J. Huang, S. Li, and B. Y. Lin Trial and error: exploration-based trajectory optimization for LLM agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL), Cited by: §1, §4.1. Suresh et al. (2021) S. Suresh, P. Li, C. Hao, and J. Neville Adversarial graph augmentation to improve graph contrastive learning. Advances in Neural Information Processing Systems 34, p. 15920–15933. Cited by: §5. Wang et al. (2024a) G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar Voyager: an open-ended embodied agent with large language models. Transactions on Machine Learning Research. External Links: Link Cited by: §1, §2.1. Wang et al. (2023) J. Wang, Y. Wang, A. Li, Y. Xiao, R. Zhang, W. Lou, Y. T. Hou, and N. Zhang ARI: attestation of real-time mission execution integrity. In 32nd USENIX Security Symposium (USENIX Security 23), p. 2761–2778. Cited by: §2.1. Wang et al. (2024b) L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin, et al. A survey on large language model based autonomous agents. Frontiers of Computer Science 18 (6), p. 186345. Cited by: §1. Wang et al. (2025a) P. Wang, Y. Liu, Y. Lu, Y. Cai, H. Chen, Q. Yang, J. Zhang, J. Hong, and Y. Wu Agentarmor: enforcing program analysis on agent runtime trace to defend against prompt injection. arXiv preprint arXiv:2508.01249. Cited by: §1, §5. Wang et al. (2022) R. Wang, P. Jansen, M. Côté, and P. Ammanabrolu ScienceWorld: is your agent smarter than a 5th grader?. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, p. 11279–11298. External Links: Document, Link Cited by: §4.1. Wang et al. (2025b) Z. Wang, H. Du, G. Shi, J. Zhang, H. Cheng, Y. Yao, K. Guo, and X. Li MindGuard: intrinsic decision inspection for securing LLM agents against metadata poisoning. arXiv preprint arXiv:2508.20412. External Links: Document, Link Cited by: §5. Wu et al. (2024) Q. Wu, G. Bansal, J. Zhang, Y. Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu, et al. Autogen: enabling next-gen llm applications via multi-agent conversations. In First Conference on Language Modeling, Cited by: §1, §2.1. Wu et al. (2025) Y. Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal IsolateGPT: an execution isolation architecture for llm-based agentic systems. In NDSS, Cited by: §1, §5. Xiang et al. (2025) Z. Xiang, L. Zheng, Y. Li, J. Hong, Q. Li, H. Xie, J. Zhang, Z. Xiong, C. Xie, C. Yang, D. Song, and B. Li GuardAgent: safeguard LLM agents via knowledge-enabled reasoning. In Proceedings of the 42nd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 267, p. 68316–68342. External Links: Link Cited by: §4.1. Yang et al. (2024) J. Yang, C. E. Jimenez, A. Wettig, K. Lieret, S. Yao, K. Narasimhan, and O. Press Swe-agent: agent-computer interfaces enable automated software engineering. Advances in Neural Information Processing Systems 37, p. 50528–50652. Cited by: §1. Yao et al. (2022) S. Yao, H. Chen, J. Yang, and K. Narasimhan Webshop: towards scalable real-world web interaction with grounded language agents. Advances in Neural Information Processing Systems 35, p. 20744–20757. Cited by: §4.1. Yao et al. (2023) S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao ReAct: synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations, External Links: Link Cited by: §1, §2.1. Yu et al. (2026) H. Yu, C. Zhang, H. Jin, S. Shi, N. Zhang, Y. T. Hou, and W. Lou MINIM: privacy-aware minimal view for agents via trusted local sanitization. In Proceedings of the 43rd International Conference on Machine Learning, Cited by: §1. Zhan et al. (2024) Q. Zhan, Z. Liang, Z. Ying, and D. Kang INJECAGENT: benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Annual Meeting of the Association for Computational Linguistics (ACL) 2024, Cited by: §1, §3.2, §5. Zhang et al. (2025) H. Zhang, J. Huang, K. Mei, Y. Yao, Z. Wang, C. Zhan, H. Wang, and Y. Zhang Agent security bench (asb): formalizing and benchmarking attacks and defenses in llm-based agents. Proceedings of ICLR 2025. Note: Comprehensive security evaluation framework including many attack/defense scenarios Cited by: §5. Zhang et al. (2021) Y. Zhang, X. Liu, C. Sun, D. Zeng, G. Tan, X. Kan, and S. Ma Recfa: resilient control-flow attestation. In Proceedings of the 37th Annual Computer Security Applications Conference, p. 311–322. Cited by: §2.1. Zhang et al. (2024) Z. Zhang, S. Cui, Y. Lu, J. Zhou, J. Yang, H. Wang, and M. Huang Agent-safetybench: evaluating the safety of llm agents. arXiv preprint arXiv:2412.14470. Cited by: §1, §4.1, §5. Zhou et al. (2025) J. Zhou, L. Wang, and X. Yang GUARDIAN: safeguarding llm multi-agent collaborations with temporal graph modeling. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §1, §1, §3.2, §4.1, §5. Zhu et al. (2025) K. Zhu, Z. Liu, B. Li, M. Tian, Y. Yang, J. Zhang, P. Han, Q. Xie, F. Cui, W. Zhang, et al. Where llm agents fail and how they can learn from failures. arXiv preprint arXiv:2509.25370. Cited by: §1, §3.2, §4.1, §5.