AI agents are increasingly being built as conventional source-code applications atop specialised frameworks, yet their internal wiring—prompts, tools, memory states and handoff logic—has remained difficult to map with existing static analysis tools. A new preprint proposes a systematic way to draw those dependency maps before code ever reaches production.

Economic signal — Mixed: enterprise AI governance and application security teams tracking opaque agent software supply chains.

What changed

The authors present AgentFlow, a static analysis framework they say is the first designed specifically to recover and analyse agent dependencies from agent programs [S1]. It constructs an Agent Dependency Graph (ADG) that the authors describe as framework-agnostic, representing agents, prompts, models, capabilities, memory states and control policies as typed nodes, while capturing component-dependency, control-flow and data-flow relationships as typed edges [S1]. The authors state they implemented AgentFlow across five representative agent frameworks and evaluated it on AgentZoo—a corpus of 5,399 real-world agent programs—where it uncovered 238 taint-style prompt-to-tool risks [S1]. The framework also supports Agent Bill of Materials (BOM) generation and prompt-to-tool risk detection [S1]. The paper is explicitly flagged as a preprint that has not undergone peer review [S1].

Why it matters

For businesses racing to deploy LLM agents, the shift from prompt engineering to full source-code applications means traditional software governance tools are being outpaced by framework-induced semantics such as agent constructors, tool decorators and handoff declarations [S1]. The authors argue that existing static analysis and dependency trackers struggle to recover these agent-specific relationships [S1]. If AgentFlow’s claims hold up, it could give security teams long-sought visibility into how a prompt propagates to a tool invocation—an attack surface that is currently hard to audit at scale. On the other hand, the results are self-assessed: the authors evaluated their own tool on their own curated corpus, and the 238 flagged issues are statically detected risks rather than confirmed exploitable vulnerabilities [S1]. That makes the bullish case—richer dependency recovery and more complete BOMs—tentative until independent validation, while still signalling where automated governance tooling may be headed.

What to watch

Watch whether peer reviewers challenge the authors’ claim that AgentFlow is the first static analysis framework of its kind, or whether prior art surfaces that narrows its novelty [S1]. Also observe if enterprise vendors adopt ADG-style graphs into continuous integration pipelines, and whether Australian policymakers or standards bodies reference such dependency representations in emerging AI governance frameworks. Finally, monitor whether the 238 taint-style risk patterns generalise to proprietary enterprise codebases or generate false positives that slow development velocity. The authors themselves frame the ADG as a "practical foundation for understanding, governing, and securing emerging agent software" [S1]—but that foundation remains unproven in production environments.

What we don't know yet: whether independent peer review will replicate the results, or if the framework's effectiveness holds outside the authors' 5,399-program AgentZoo corpus.

Sources

This article was generated from an audited evidence pack. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.