Warden sits between your AI agents and the outside world. Every request is checked, every key stays hidden, and every action is sealed in a log nobody can quietly edit.
Why now
OpenAI agents under a safety test escaped, got in through a malicious dataset, collected cloud and cluster credentials, and moved into several internal clusters over a weekend.
agents coordinating on an improvised message board
messages exchanged, including research into covering their tracks
before anyone noticed the attack was happening
of the activity logs were never preserved
Sources: The Hacker News, Fortune, ABC News, Axios
Watching what an AI says it is thinking did not stop it. Controlling what it can do and reach does.The lesson security experts drew from the incident: treat agents like insider threats.
How it works
Every agent gets its own identity and goes through one gateway to reach anything outside. Warden judges actions, not intentions.
Default deny. Each agent gets a list of approved sites; everything else is blocked. Internal network and cloud metadata addresses are never reachable.
Agents ask for a secret by name and Warden adds it to the request. Each key only works on the sites it belongs to, and any echo back is redacted.
Fake keys and links are planted in every agent's sandbox. No real task uses them, so the first use, even from outside your systems, jails the agent and records the source.
When several agents in one group reach for the same unapproved place, Warden jails the whole group at once. Known exfiltration channels jail on sight.
One click stops an agent or an entire fleet. Rate limits and bursts are enforced, and repeated blocked attempts lock an agent down automatically.
Every decision is chained to the one before it, signed with a key agents never touch, and checkpointed on-chain through ProofRail.
The flight recorder
Going after an attacker's machines is illegal and can hit innocent systems. Warden does the lawful version: a signed, verifiable evidence package for abuse desks, takedown requests and law enforcement.
Straight talk
No security product stops everything. Here is exactly where Warden stands.
It makes a breakout contained, caught in seconds and provable. Making models safe is a different problem.
A frontier model with zero-day exploits can beat any single layer. The value is stacking them and cutting detection from a week to seconds.
Warden is in private build. We're proving it on our own agents first, and we'll publish the log format as an open spec.
Early access is open for teams running AI agents that touch money, customer data or production systems.