Abstract
Large Language Model (LLM) agents offer a powerful new paradigm for solvingvarious problems by combining natural language reasoning with the execution ofexternal tools. However, their dynamic and non-transparent behavior introducescritical security risks, particularly in the presence of prompt injectionattacks. In this work, we propose a novel insight that treats the agent runtimetraces as structured programs with analyzable semantics. Thus, we presentAgentArmor, a program analysis framework that converts agent traces into graphintermediate representation-based structured program dependency representations(e.g., CFG, DFG, and PDG) and enforces security policies via a type system.AgentArmor consists of three key components: (1) a graph constructor thatreconstructs the agent's runtime traces as graph-based intermediaterepresentations with control and data flow described within; (2) a propertyregistry that attaches security-relevant metadata of interacted tools \& data,and (3) a type system that performs static inference and checking over theintermediate representation. By representing agent behavior as structuredprograms, AgentArmor enables program analysis for sensitive data flow, trustboundaries, and policy violations. We evaluate AgentArmor on the AgentDojobenchmark, the results show that AgentArmor can reduce the ASR to 3\%, with theutility drop only 1\%.