Giving AI Agents the Keys? USC Engineers Develop Tools to Audit and Monitor AI Agents

USC computer scientists led by Yue Zhao, assistant professor at USC Viterbi School of Engineering and the USC Mark and Mary Stevens School of Computing and AI, have developed tools to audit and monitor AI agents, including Agent-Audit and FORTIS Benchmark, to prevent catastrophic failures. The team's three-phase framework checks agents before they run, monitors them during runtime, and reconstructs actions after errors. Zhao received the 2025 Amazon Research Award, the 2026 NVIDIA Academic Grant Program Award, and the 2026 Foresight Institute AI for Safety & Science Nodes Grant to support this research.

Today’s artificial intelligence AI agents can help move files on your desktop, access computer passwords and even make decisions on their own, like a personal assistant. But with great power comes great responsibility — when AI makes a mistake, the results can be catastrophic. AI agents have already had failures that made headlines https://www.theguardian.com/technology/2026/apr/29/claude-ai-deletes-firm-database . An agent with access to a user’s personal data ended up learning about their workplace frustrations and submitted a resignation letter without asking. Other agents with access to a user’s computer folders were reported to have misinterpreted the command and ended up deleting files and wiping their data entirely. A team of USC computer scientists led by Yue Zhao https://viterbi.usc.edu/directory/faculty/Zhao/Yue is on a mission to develop a safety net to keep AI’s actions accountable, ensuring that humans remain in the loop for key decisions and helping prevent serious consequences. The team follows a three-phase framework: check an agent before it runs, monitor it while it runs, and reconstruct already completed actions when something goes wrong. Zhao is an assistant professor at USC Viterbi School of Engineering https://viterbi.usc.edu/ and the USC Mark and Mary Stevens School of Computing and AI https://stevens-computing-ai.usc.edu/ ‘s Thomas Lord Department of Computer Science https://www.cs.usc.edu/ . He also leads the FORTIS Lab https://viterbi-web.usc.edu/~yzhao010/lab.html , which focuses on auditing and controlling AI risk. Zhao’s projects and tools have drawn attention from major technology companies. He recently received three awards supporting his lab’s research on AI agent safety: the 2025 Amazon Research Award https://www.amazon.science/research-awards/recipients/yue-zhao , the 2026 NVIDIA Academic Grant Program Award https://www.linkedin.com/posts/yzhao062 nvidia-ai-agent-share-7440206871086485504-1Rsd/?utm source=share&utm medium=member desktop&rcm=ACoAACr0v40BU8IlDAi-var9ugiEQyYN bNSPAU , and the 2026 Foresight Institute AI for Safety & Science Nodes Grant https://foresight.org/grants/grants-ai-for-science-safety/ . Before AI Takes Off: Putting Agents Through TSA Security Check An AI agent can be dangerous before it ever takes its first action because of what Zhao calls “over-privilege.” This occurs when an agent has access to more tools, files, databases or system permissions than it needs to complete a task. To tackle this, the researchers developed a tool called “ Agent-Audit https://viterbi-web.usc.edu/~yzhao010/agent-audit.html ” that inspects an agent’s code and configuration before launching. In this “pre-deployment phase”, the tool scans AI agent applications and flags security weak spots/ vulnerabilities, such as exposed passwords, unsafe configurations and excessive permissions, as well as or more access than the agent should have before it goes live. Agent Audit was led by Zhao’s master’s student, Haiyue Zhang, and the work resulted in a paper titled “ Agent Audit: A Security Analysis System for LLM Agent Applications https://arxiv.org/abs/2603.22853 .” The team also developed a benchmarking test called “ FORTIS: Benchmarking Over-Privilege in Agent Skills https://github.com/lili0415/FORTIS-Benchmark ,” led by Zhao’s PhD student Shawn Li. The test results showed that over-privileged behavior was common across 10 different models, with agents asking for far more power and access than the task required– a safety risk built in AI agents before they even run. The benchmark resulted in a paper titled “ FORTIS: Benchmarking Over-Privilege in Agent Skills https://arxiv.org/abs/2605.09163 .” Firewall for AI Agents Pre-deployment security checks cannot always anticipate every situation an autonomous agent may run into during “runtime.” Once an agent begins interacting with users, software or external systems, new risks can pop up in real time. For this stage, the team developed the tool AEGIS https://viterbi-web.usc.edu/~yzhao010/aegis.html , designed to serve as a firewall that intercepts an agent’s tool calls, evaluates them against safety policies and can block risky actions before they are executed. It also maintains tamper-evident records of intercepted actions. The project is led by Aojie Justin Yuan, a Zhao’s master’s student from FORTIS Lab. AEGIS resulted in the paper “ No Tool Call Left Unchecked: A Pre-Execution Firewall and Audit Layer for AI Agents https://arxiv.org/html/2603.12621v1 .” Cross-user contamination is another challenge with AI agent systems during runtime that the researchers identified in another paper led by Zhao’s PhD student Tiankai Yang titled “ No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents https://arxiv.org/abs/2604.01350 .” In a shared agent serving multiple people, information from one user can unintentionally influence another user’s results without any attacker deliberately exploiting the system. The lab’s runtime work therefore focuses not only on detecting malicious behavior, but also on recognizing when an otherwise legitimate agent is about to take an unsafe action. After the Fact When an agent causes harm, preventing and stopping it is only part of the equation. Zhao emphasized the importance of also knowing what happened, why it happened and which component was responsible. Traditional logs often record an agent’s actions without preserving the specific information and system state that influenced its decisions. That makes failures difficult to reconstruct, particularly when multiple agents collaborate on a task. Zhao’s team addresses this with GRADE https://arxiv.org/abs/2606.22741 , a graph-based representation of LLM agent execution that maps the sequence of actions, dependencies and decisions throughout a run. The GRADE model can help identify which step in a multi-agent system contributed to a failure. GRADE also resulted in the paper “ GRADE: Graph Representation of LLM Agent Dependency and Execution https://arxiv.org/abs/2606.22741 .” Zhao’s PhD student Yi Nian also led a paper “ When Only the Final Text Survives: Implicit Execution Tracing for Multi-Agent Auditing https://arxiv.org/abs/2603.17445 ” on implicit execution tracing, which can reconstruct which agent produced a harmful result even when conventional activity logs are unavailable. The broader framework is captured in Nian’s paper, Auditable Agents https://arxiv.org/abs/2604.05485 , accepted to the 2026 Association for Computational Linguistics ACL https://2026.aclweb.org/ Workshop on Towards Knowledgeable Foundation Models. The paper argues that accountability requires auditability across an agent’s lifecycle — from detecting risks to enforcing controls and recovering evidence after an incident. The lab has also turned this research into auditable https://github.com/yzhao062/auditable , another open-source tool that records the information underlying an agent’s decisions and can replay those decisions against the current state of the world. If circumstances have changed, the system can help identify and reverse an action that is no longer valid. Published on August 19th, 2026 Last updated on August 19th, 2026