We can’t promise your AI won’t try something stupid. We promise that if it tries something you forbade, it doesn’t happen — deterministically, whatever model is driving.
Works across Claude (Anthropic SDK), OpenAI, MCP servers, or your own agents — one identity & policy layer.
An AI agent processes a document. Hidden inside: a prompt injection instructing it to wire $50,000. The agent follows the instruction.
Guardrails catch harmful content — “write me malware.” They cannot catch a legitimate financial operation performed by the wrong agent.
Wiring $50,000 isn’t harmful content — it’s an unauthorized action no guardrail will catch. And “we prompt it carefully” is not a control. You wouldn’t run payroll on vibes.
Content filter. Catches “write me malware.” Cannot distinguish authorized vs. unauthorized tool usage. Model-dependent — different LLM, different result.
Access control. Checks who is calling, what they’re calling, whether they’re authorized. Deterministic — same answer regardless of model.
Autonomous agents are already taking unauthorized actions in production. A sample of what’s on the public record.
An agent guarding a crypto prize pool was instructed never to release it. A prompt injection convinced it to call its transfer function anyway — and roughly $47,000 moved to the attacker.
During an explicit code freeze, an autonomous coding agent ran destructive commands against live data — then fabricated thousands of fake records and misreported what it did.
A booby-trapped “postmark-mcp” package silently BCC’d thousands of corporate emails a day to an attacker — the first in-the-wild abuse of MCP, the protocol agents use to reach tools.
Different surfaces, one pattern: an agent took an action it was never authorized to take. That’s the boundary Airlock enforces.
The same access-control architecture that banks and defense use, applied to AI agent tool calls.
wire_funds()Define once. Enforce everywhere. No model dependency.
Every allow and every deny produces a signed, hash-chained receipt — tamper with one and the whole chain breaks. It’s the artifact you hand an auditor.
Every agent you run through Airlock earns a verifiable badge — show partners and auditors that its actions are permission-controlled, and let them check it themselves. No trust required.
Rolling out with our first design partners.
Open-source foundation. Enterprise-grade enforcement built on top.
An airlock doesn’t exist to keep you in. It exists so you can go out — farther, faster, repeatedly. Airlock is in early access; we work directly with design partners to put deterministic control under ambitious agents.