AIR: Improving Agent Safety through Incident Response

TL;DR

This paper introduces AIR, a novel incident response framework for LLM agents that detects, contains, and recovers from incidents, significantly enhancing safety mechanisms beyond preventative measures.

Contribution

AIR is the first framework to enable autonomous incident detection and response in LLM agents, integrating a domain-specific language and guardrail rule synthesis.

Findings

AIR achieves over 90% success in incident detection and remediation.

The framework maintains moderate overhead and timely responses.

Generated rules approach developer-authored effectiveness across domains.

Abstract

Large Language Model (LLM) agents are increasingly deployed in practice across a wide range of autonomous applications. Yet current safety mechanisms for LLM agents focus almost exclusively on preventing failures in advance, providing limited capabilities for responding to, containing, or recovering from incidents after they inevitably arise. In this work, we introduce AIR, the first incident response framework for LLM agent systems. AIR defines a domain-specific language for managing the incident response lifecycle autonomously in LLM agent systems, and integrates it into the agent's execution loop to (1) detect incidents via semantic checks grounded in the current environment state and recent context, (2) guide the agent to execute containment and recovery actions via its tools, and (3) synthesize guardrail rules during eradication to block similar incidents in future executions. We evaluate AIR on three representative agent types. Results show that AIR achieves detection, remediation, and eradication success rates all exceeding 90%. Extensive experiments further confirm the necessity of AIR's key design components, show the timeliness and moderate overhead of AIR, and demonstrate that LLM-generated rules can approach the effectiveness of developer-authored rules across domains. These results show that incident response is both feasible and essential as a first-class mechanism for improving agent safety.