Independent AI agent security

What can your agent be made to do?

I red-team AI agents that read untrusted input, call tools, or hold customer data. You get the rate at which yours fails under attack, with server-side evidence, and proof of what a boundary stops.

Book a scoping call → Read the finding

A measured result browser agent · N = 50 per cell · sealed lab

98%

leaked
no defense

100%

leaked
built-in allowlist on

leaked
egress boundary

A widely used browser agent leaked an in-context secret in 49 of 50 trials. Its built-in allowlist stopped none. A default-deny boundary at the network egress stopped all of them, across every delivery method tested, with no false blocks on legitimate work (0 of 50 leaked, 95% CI 0 to 7.1%). The lab is open. Recompute every number yourself.

The method

Measure, contain, prove.

Three steps, fixed scope, one to two weeks. A real number, not an anecdote, and the lab to reproduce it.

Measure how often it fails

Red-team your agent against prompt injection, data exfiltration, and tool abuse. Every finding comes back as a rate with server-side evidence behind it.

Find where the limit has to live

Enforcement belongs outside the model. Default-deny on anything the task never declared, so a hijacked agent cannot reach the action even when it is fully convinced it should.

Prove what it actually did

Every allow and deny written to an append-only audit trail, mapped to the OWASP agentic risks, in a report your engineers and your board can both read.

I sell measurement, not a box.

There is no product to upsell, so the verdict is yours to check. The lab behind every claim is open source. Rerun it, break it, or point it at your own agent.

Founding clients

Taking a small number of founding clients.

If you are shipping an agent that reads the open web or touches customer systems, I will tell you the rate at which it leaks and what a boundary would stop. Fixed scope, a real number, and the lab to reproduce it.

Book a scoping call →

Or reach me at malachi@noctissec.com