OPENXEL Secure · security engineering

Security engineering for software that acts on its own

Bought by the CISO and AppSec. Application security assumes a user behind every action, and an agent breaks that assumption.

The failure

What goes wrong here

Application security assumes a user behind every action. An agent breaks that assumption. It is a principal with credentials, a tool list and an input channel that an attacker can write to directly.

We design against SOC 2, PCI and GDPR controls. We have not completed an audit, so we write aligned and never certified or compliant. For the EU AI Act, the honest word is readiness.

What we build

  • A threat model for software that acts, including the prompt that is itself the attack
  • Least privilege on every tool grant, reviewed as a change rather than issued as a default
  • Identity for software, separate from the human identity it works on behalf of
  • Model provenance — what ran, which version, on what
  • Keys you hold, in your infrastructure
The boundary around software that acts An attacker writes into the agent's input channel, so the prompt is itself the attack. The boundary does not prevent the attempt. Least privilege on each tool grant bounds what the attempt can reach. the input channel — an attacker can write here A prompt that is the attack the boundary The agent software identity, not a user least privilege · per tool keys held by you model provenance recorded replayable from inputs The boundary bounds the blast radius. It does not stop the attempt, and saying otherwise is how these documents lose their reader.
What the boundary does and does not do. It bounds the blast radius of a prompt injection. It does not prevent one, and a threat model that claims otherwise will not survive its first review.
The artifact

What you keep

An authority model and an agent threat model, written for a security team to review rather than for a brochure.

Adjacency

What ships beside it

Least privilege only means something once something is asking for privilege. The harness and the boundary ship together. See agent harnessing.

Send us the problem

Describe what is stuck. We will come back with an architecture, a timeline and the first commit.

Send us the problem See the six-step path