GuardianAgentBench: Even the Best Agent Guardrails Only Hit 74.8% Accuracy
Source: arXiv — 2026-07-23
Summary
GuardianAgentBench is a new 580-scenario benchmark spanning six domains that stress-tests LangChain, LlamaIndex, and Vectara-based agents under five distinct adversarial attack modes. Even the best-performing model/guardrail configuration only reaches 74.8% accuracy, and the failure modes split in an interesting way: stronger models tend to under-call tools (too cautious to act), while weaker models over-call or mis-select tools (too eager, wrong choice). The paper's own guardrail layer recovers 19.9% of failures compared to relying on system-prompt-based defenses alone, and accuracy degrades predictably as the number of available tools and conversation turns increases.
Key Takeaways
- Best-in-class agent + guardrail combination still only reaches 74.8% accuracy across the benchmark's 580 adversarial scenarios — a hard number showing agent safety layers are far from solved even with strong models.
- Failure modes differ by model strength: stronger models tend to under-call tools (excessive caution), while weaker models over-call or mis-select tools (poor judgment about when/what to invoke) — meaning "just use a bigger model" doesn't uniformly fix agent reliability.
- Accuracy degrades monotonically as tool-set size grows and as conversation turn depth increases — agents get measurably less reliable the more tools they have available and the longer the interaction runs.
- A dedicated guardrail layer recovered 19.9% of failures that a system-prompt-only defense missed, suggesting architectural guardrails outperform "just tell the model to be careful" prompting.
Reel Script
Hook (~18s): The best agent and guardrail combination researchers could test only got 74.8% accuracy against realistic attacks. That's the current ceiling for agent safety in production — not a bug, the state of the art.
Core Concept (~90s): A "guardrail" in agent systems is basically a checkpoint that sits between the model's decision and the tool actually firing — think of it as a second set of eyes checking "does this action make sense and is it safe" before the agent is allowed to, say, delete a file or send an email. This benchmark tests 580 scenarios across six domains, each rigged with one of five different adversarial attack styles, against agents built on popular frameworks like LangChain and LlamaIndex. What they found cuts against the intuitive assumption that a smarter model just means a safer agent: stronger models actually got too cautious, refusing to call tools they should have used, while weaker models swung the other way, calling the wrong tool or calling tools they shouldn't have. Neither failure mode is "safe" — one just fails by doing nothing useful, the other fails by doing something wrong.
Hands-On (~110s): Two numbers tell the real story here. First, 74.8% — that's the accuracy ceiling for the single best model-and-guardrail configuration the researchers tested, meaning roughly one in four interactions still goes wrong even in the best setup available today. Second, 19.9% — that's how many additional failures got caught specifically by adding a dedicated guardrail layer, on top of whatever a system prompt alone could catch. In other words, telling your agent "be careful" in its instructions recovers noticeably less than putting an actual architectural check between decision and action. And there's a scaling problem baked in: the more tools you give an agent, and the longer the conversation runs, the worse accuracy gets — monotonically, not randomly. That means the "give the agent everything it might need" instinct is directly working against reliability.
Takeaway (~25s): If your production agent has a big tool belt and long-running conversations, you should assume its real-world accuracy is meaningfully below whatever number looked good in a demo. Guardrails as actual architecture — not just prompt instructions — are earning their keep here, and trimming your agent's tool set is a legitimate reliability lever, not just a nice-to-have.