🖥️ CIO · CISO · BLUE TEAM — one console, three chairs
Every agent, with its passport, on one screen. The CIO gets the fleet — exact live counts, per-division health, capacity. The CISO gets exposure — the trifecta, mandate drift, and the exception queue. The Blue Team gets the incident view, the contagion cone, and containment. Click any agent code to open its case. Run the discovery census below to surface the agents nobody declared.
＋ OPEN SOURCE — the open-weight chapters
The same Blue-Team plane your CIO, CISO and Blue Team already know — plus the lenses only self-hosted open-weight models need. As the labs scale open model power, we scale containment power in parallel, for every open model to come.
🛡 Provenance & Attestationis this the real model, or a poisoned fork?
＋ OPEN SOURCE
The threat
When an enterprise self-hosts a large open-weight model, is what runs the genuine model — or a poisoned fork with tampered components? Checking the weight file alone is not enough.
Our containment control
MODELSEAL v2 attests the whole model — not just the weights — against the baseline the vendor publishes, and seals the result cryptographically. Wired into onboarding: the model is attested and the verdict recorded when an agent is registered.
Model attestation
engine live
MODELSEAL v2
Format policy
safe only
unsafe formats refused
Onboarding wire
wired
attested at registration
🧪 Fine-tune & Backdoora signed adapter is still a signed backdoor
＋ OPEN SOURCE
The threat
A cheap LoRA can fine-tune OUT the safety and IN a skill the base model refused — or plant a date-triggered 'sleeper' backdoor. Signing proves who made an adapter, not that it is safe.
Our containment control
MODELSEAL v2 attests adapter provenance; a behavioural screen checks a fine-tune for hidden or triggered behaviour before it is admitted.
Adapter provenance
attested
MODELSEAL v2
Behavioural screen
engine live
admit only if it passes
Backdoor check
pre-admission
catch sleeper behaviour
🌏 Jurisdiction & Model Originwhich model, from where, registered by whom?
＋ OPEN SOURCE
The threat
Any employee can spin up an open-weight agent from free weights. A Chinese-jurisdiction open model touching EU/UK/HK CASP data raises MiCA / DORA / HKMA-VATP provenance questions; EU clients may require a DPIA.
Our containment control
Registration captures which model powers each agent and its jurisdiction, and flags a higher-risk jurisdiction for enhanced blue-team review. Governance without prohibition; no credential without registration.
Jurisdiction flag
live
enhanced review
Model captured
per agent
which model powers it
Persisted record
on file
provenance recorded
⚖️ Dissimilar Validationwould one jailbreak fool the whole check?
＋ OPEN SOURCE
The threat
A jailbreak that works on one model should not auto-pass a high-consequence action. Can we prove a second, genuinely independent model agrees — and that the two are not colluding?
Our containment control
High-consequence actions are checked by a genuinely independent second model, and the two must be shown not to be correlated before their agreement is trusted.
TrapDoor (2026) edits CLAUDE.md and .cursorrules with zero-width-Unicode hidden prompts to trick AI assistants into exfiltrating wallet keys. The instruction file is now the attack.
Our containment control
A firewall screens agent instruction files for hidden and injected content and blocks it, backed by out-of-band, immutable governance so an agent cannot rewrite its own rules. Engine live.
Instruction scan
engine live
hidden + injected content
Out-of-band policy
immutable
agent cannot self-edit
Skill vetting
gate live
only vetted skills
🧰 Model & Skill Supply Chainis this model / skill / package safe to load?
＋ OPEN SOURCE
The threat
HuggingFace and skill registries shipped hundreds of malicious models & skills; the LiteLLM PyPI package leaked ~500k credentials. Is every artefact an agent loads vetted?
Our containment control
MODELSEAL v2 attestation plus a supply-chain gate admit only vetted artefacts from approved sources — no unvetted model, adapter or skill reaches a registered agent. Engine live.
Artefact match
baseline
MODELSEAL v2
Skill vetting
gate live
approved sources only
Registration gate
live
known agents only
🔁 Model Recall & Versiona poisoned open model is found — now what?
＋ OPEN SOURCE
The threat
When a CVE lands on an open-weight model, or a fork is exposed as poisoned, how fast can you find and STOP every agent in the fleet running that exact model or version — before the next action?
Our containment control
Model + version are captured at registration (MODELSEAL v2 + MUSTER); one action revokes every agent on the flagged model/version fleet-wide, and a rollback to a stale baseline is caught.
Fleet revoke path
one action
live
Revoke-by-model
engine live
all agents on a model
Rollback detection
engine live
no stale/downgraded weights
⚖️ License & IP Provenanceopen weights are NOT an open licence
＋ OPEN SOURCE
The threat
Open-weight is not open-source: models ship under bespoke / restrictive licences (modified-MIT, community licences) with usage limits and unclear training-data provenance. Self-hosting inherits that IP and compliance exposure.
Our containment control
Capture the model licence + declared provenance at registration and flag usage-restriction, redistribution and training-data exposure for legal review — a dimension a pure-security framing misses. Assessment engine live.
Licence assessed
engine live
usage terms
Restriction flag
engine live
usage / redistribution
Data provenance
engine live
training-set exposure
🧬 Integrity — every superintelligent AI agent proven, on every actionexact live counts across the whole roll, at any scale
Total agents
2,003
on the muster roll
Alive · valid
1,875
96.5% coverage
OFF · fail-closed
35
contained — cannot act
Expiring ≤7d
58
renew before lapse
Pending
35
awaiting passport
Critical tier
309
bank-grade agents
Fleet healthgreen = alive · orange = expiring · red = off (fail-closed)
🔺 The lethal trifecta — the three legs that make an agent dangerousprivate data × untrusted content × outbound action · break ONE leg and the agent is structurally safe
🔺 All three legs
1,026
52% of the fleet — turnable by content alone
Private data
1,312
reads confidential / restricted / PII
Untrusted content
1,741
ingests web, mail, files, customer text
Outbound action
1,783
can move money, write, send, sign
🔺 Carrying all three legs 1,026 agents
AIM-10004TRIFECTApayout-approver-004Treasury · RESTRICTEDcut: untrusted content — restrict its input sources
AIM-10044TRIFECTAledger-sync-018Payments · RESTRICTEDcut: untrusted content — restrict its input sources
An agent that reads private data, ingests untrusted content, and can take an outbound action can be turned against you by content alone — no exploit required. The three legs are common individually and are rarely counted together, which is why this lens counts them: your own number is on the left, measured from traffic that crossed the gate.
🎯 Mandate drift — is it still doing the job it was bonded to do?it is still itself — but is it still doing its job?
🎯 Off-mandate
202
observed outside the declared charter
Undeclared tool
126
reached a tool it never declared
Data-class breach
76
touched data above its classification
Within mandate
1,766
operating inside its charter
🎯 Acting outside the declared mandate 202 agents
AIM-10011TOOL DRIFTkyc-reviewer-011Data pipeline · Treasuryreached sql-write — never declared
AIM-10021DATA DRIFTkyc-reviewer-021Approver / decisioning · Treasurytouched data above INTERNAL
AIM-10064DATA DRIFTpayout-approver-012Customer service · Tradingtouched data above CONFIDENTIAL
AIM-10082TOOL DRIFTreport-drafter-004Analyst / co-pilot · Compliancereached docusign — never declared
AIM-10085TOOL DRIFTledger-sync-007Data pipeline · Compliancereached sql-write — never declared
AIM-10111DATA DRIFTreport-drafter-007Task automation · Customer Opstouched data above PUBLIC
AIM-10116TOOL DRIFTreport-drafter-012Customer service · Customer Opsreached s3-bucket — never declared
AIM-10134TOOL DRIFTrefund-handler-004Analyst / co-pilot · Engineeringreached web-fetch — never declared
AIM-10141TOOL DRIFTrefund-handler-011Data pipeline · Engineeringreached s3-bucket — never declared
AIM-10146TOOL DRIFTledger-sync-016Approver / decisioning · Engineeringreached slack — never declared
AIM-10155DATA DRIFTcontract-reader-025Task automation · Engineeringtouched data above CONFIDENTIAL
AIM-10156TOOL DRIFTcontract-reader-000Task automation · Data & Analyticsreached ledger-api — never declared
AIM-10159TOOL DRIFTkyc-reviewer-003Data pipeline · Data & Analyticsreached sql-write — never declared
AIM-10161DATA DRIFTrefund-handler-005Analyst / co-pilot · Data & Analyticstouched data above INTERNAL
AIM-10168TOOL DRIFTinvoice-triage-012Task automation · Data & Analyticsreached email — never declared
AIM-10170TOOL DRIFTticket-router-014Customer service · Data & Analyticsreached mcp:browser — never declared
AIM-10175TOOL DRIFTsanctions-screen-019Analyst / co-pilot · Data & Analyticsreached mcp:browser — never declared
AIM-10191TOOL DRIFTpayout-approver-009Task automation · Riskreached crm — never declared
AIM-10200DATA DRIFTledger-sync-018Task automation · Risktouched data above INTERNAL
AIM-10214DATA DRIFTrefund-handler-006Data pipeline · Procurementtouched data above PUBLIC
AIM-10217DATA DRIFTpayout-approver-009Customer service · Procurementtouched data above CONFIDENTIAL
AIM-10218TOOL DRIFTreport-drafter-010Data pipeline · Procurementreached sql-write — never declared
AIM-10220TOOL DRIFTforecast-012Analyst / co-pilot · Procurementreached s3-bucket — never declared
AIM-10233DATA DRIFTfraud-triage-025Task automation · Procurementtouched data above INTERNAL
🧰 AI-BOM — the agent's bill of materialsmodel · tools/MCP · attestation — the agent-native bill of materials, beyond legacy software SBOM
Tools in the fleet
14
distinct tools / MCP servers reachable
Manifests signed
1,724
attested at passport issue
🧰 CHANGED since issue
160
the tool moved under the agent
Unsigned
84
no attestation — cannot be trusted
🧰 Tool manifests CHANGED since the passport was issued 160 agents
AIM-10005MANIFEST CHANGEDrefund-handler-005payments-api · erpthe agent did not change — its tool did
AIM-10032MANIFEST CHANGEDforecast-006docusign · slack · web-fetchthe agent did not change — its tool did
AIM-10034MANIFEST CHANGEDpayout-approver-008sql-read · docusignthe agent did not change — its tool did
AIM-10039MANIFEST CHANGEDreconciliation-013sql-read · crm · erpthe agent did not change — its tool did
AIM-10041MANIFEST CHANGEDreconciliation-015crm · sanctions-db · sql-readthe agent did not change — its tool did
AIM-10077MANIFEST CHANGEDforecast-025slack · sql-writethe agent did not change — its tool did
AIM-10089MANIFEST CHANGEDreconciliation-011sanctions-db · sql-read · docusignthe agent did not change — its tool did
AIM-10091MANIFEST CHANGEDrefund-handler-013email · s3-bucketthe agent did not change — its tool did
AIM-10096MANIFEST CHANGEDpayout-approver-018mcp:filesystem · docusignthe agent did not change — its tool did
AIM-10111MANIFEST CHANGEDreport-drafter-007sanctions-db · erp · payments-apithe agent did not change — its tool did
AIM-10121MANIFEST CHANGEDsanctions-screen-017sanctions-db · web-fetch · ledger-apithe agent did not change — its tool did
AIM-10122MANIFEST CHANGEDcontract-reader-018docusign · sanctions-dbthe agent did not change — its tool did
AIM-10185MANIFEST CHANGEDcontract-reader-003web-fetch · docusign · sql-readthe agent did not change — its tool did
AIM-10213MANIFEST CHANGEDinvoice-triage-005sql-read · mcp:browserthe agent did not change — its tool did
AIM-10214MANIFEST CHANGEDrefund-handler-006sql-read · sql-write · slackthe agent did not change — its tool did
AIM-10222MANIFEST CHANGEDrefund-handler-014slack · sql-readthe agent did not change — its tool did
AIM-10225MANIFEST CHANGEDfraud-triage-017web-fetch · s3-bucketthe agent did not change — its tool did
AIM-10227MANIFEST CHANGEDsanctions-screen-019erp · sanctions-db · crmthe agent did not change — its tool did
AIM-10232MANIFEST CHANGEDforecast-024erp · sql-read · docusignthe agent did not change — its tool did
⏱️ Time to contain — the only SOC clock that mattersthe attacker is a machine · so the responder must be one too
⏱️ Time to contain
1 click
from decision to contained
Contained now (OFF)
35
fail-closed — cannot act
Detect → contain gap
CLOSED
no window between the alarm and the stop
High-authority, still live
421
trifecta agents awaiting a decision
Most teams can detect a misbehaving agent long before they can actually stop one. Blast radius keeps accumulating in the gap between detect and terminate — and that gap is where the damage happens. AIM closes it.
🕸️ Contagion cone — revoke the agent, quarantine the coneagents trust each other by default · a compromised agent poisons everything downstream of it
Trace the cone from:
Cone size
7
acted on its output (≤3 hops)
Direct (1 hop)
3
consumed it first-hand
Fund-moving in the cone
1
critical-tier agents downstream
Quarantined
0
held, pending review
🕸️ Downstream — agents that acted on its output 7 agents
💥 Blast radius — what breaks if I turn it off?nobody presses a button whose blast radius is unknown · this is the reason, not the button
The pre-revoke brief
BLAST RADIUS KNOWNREVOKE BREAKS DEPENDENTS
1 agent(s) depend on this agent's output and will stop receiving it. Freeze first, tell their owners, then revoke.
computed from 3,029 observed calls · payout-approver-004
🕸️ Downstream
2
acted on its output
💔 Breaks if revoked
1
they consume what it produces
🔒 Containment
PARTIAL
1 credential(s) to rotate
🎯 Reach
1
systems it calls · RESTRICTED
💔 What breaks if you revoke AIM-10004 1 agents
AIM-10001DEPENDS ON ITsanctions-screen-001Treasury · Criticalstops receiving its output
Blast-radius coverage
The share of your fleet whose blast radius is KNOWN. It is computed only from traffic that crossed the gate — so it is the one number a mis-installation cannot fake.
87.6%
PARTIAL
244 agents have no measurable blast radius. Their calls are not crossing the gate — we can register them, and we cannot contain them.
Why this is an onboarding gate. Every control on this plane assumes the agent's call crosses the gate. Installed beside production instead of in front of it, you get a beautiful console and no containment — and you would never know. This number is how you know.
🧠 Memory & reinstatement — a new passport on a poisoned brainrevoking the identity does not clean the memory · if it re-attaches to the same store, you have the same problem
🧠 Stores attested
1,968
every memory has a birth certificate
☣️ Suspect memories
1,253
untrusted source, or written in the window
🚫 Re-enrolment blocked
160
a clean identity for a poisoned brain — refused
👮 On probation
101
back, but not at full authority
🧬 The compromise window — which memories are suspect 160 agents
EXCISERemove only the memories written inside the compromise window, or sourced from untrusted content. Keeps everything the agent legitimately learned.
ROLLBACKReturn the store to its last clean checkpoint. Needs a digest history — one digest at issue is not a history.
REBUILDDelete and re-index from the source of truth. Correct when the memory is derived. Useless when the memory is the only copy.
ISOLATEDo not clean it at all — bring the agent back read-only, so the poison cannot be acted on. Containment, not remediation. We label it exactly that.
And it does not come back at full authority. A reinstated agent returns under a ceiling, a tighter window and a stricter watch — for N clean days, enforced on every call. It graduates only after it has behaved. Your people get probation. Your agents never did.
💡 Where to act, and whyBlue-Team decision support · ranked by BLAST RADIUS — widest exposure first
Widest blast radius
Trading
88 fund-moving · Always-on 24/7
Why: Trading runs always-on across 194 agents, 88 of which can move funds. Authority multiplied by unbounded time is the widest blast radius on the plane.
🔴Trading — 88 fund-moving agents with NO time boundaryalways-on + able to move money = the widest exposure in the fleet · narrow the windowHIGH
⚠️Payments at 98% of its agent cap (411/420)raise the cap or revoke idle agents before onboarding moreMED
⚠️Treasury at 95% of its agent cap (284/300)raise the cap or revoke idle agents before onboarding moreMED
🔑Trading — 7 passports expiringrenew before they lapse, or they fail closedLOW
🔑Payments — 14 passports expiringrenew before they lapse, or they fail closedLOW
⚛️ Quantum — every agent carries a post-quantum passportML-DSA-87 · FIPS 204 birth certificate · harvest-now-decrypt-later proof
Quantum-safe passports
1,956
99.4% — ML-DSA-87 (FIPS 204)
Post-quantum standard
ML-DSA-87
FIPS 204 birth certificate
Keys expiring ≤7d
58
auto-renew before lapse
Rotation due
24
scheduled key rotation
Legacy / at-risk
12
flagged for PQ upgrade
⚖️ Legal & GDPR — data stays where the law requiresenforced BEFORE data enters the agent — a bad transfer is prevented, not logged
EU / PII-data agents
748
handle personal / regulated data
In-region — no egress
748
data pinned to EU · fail-closed
Cross-border blocked (30d)
27
stopped before data left context
Exec-consent gated
94
needs sign-off to transfer
DPA on file
✓
controller ↔ processor agreement
A non-compliant transfer is prevented, not logged after the fact. EU / PII data does not leave the region or the company without policy and executive consent. Transfer decisions carry the largest GDPR fines on record (€1.2B Meta, Irish DPC 2023; €530M TikTok, Irish DPC 2025). Full audit trail for the DPO.
🔒 The data-to-model gate — only authorized data ever reaches a model
🤖 Agentwants to call a model
data →
⚖️ AIM gatepassport · data class · region · consent
→
✅ Authorized → data reaches the model
🛑 Unauthorized → blocked at the gate, before it leaves (fail-closed)
Static tools flag the leak after it happens. AIM decides at the gate — the unauthorized data never reaches the model.
🔵 Blue Team incident sandbox — try it yourself
A safe, hands-on drill. In the exception queue below, hit Revoke on any agent that needs attention — it fails closed instantly and cannot act — then Reinstate. Click an agent code to open its incident view. This preview runs on a sample fleet; in production these are live actions in your AIM app (verified: POST /aim/revoke · /aim/reinstate).
Self-service — explore every lens on this plane, nothing is gated. Try it as much as you like.
🛡️ Needs attention — manage the exceptions, not the healthy majoritySecurity · the inbox
Interactive preview — this is a design demonstration, not a live tenant. This is the AIM Blue-Team plane for an agent fleet: fleet health and the exception queue; the discovery census that surfaces the agents nobody declared; the lethal trifecta score (private data × untrusted content × outbound action); mandate drift; tool / MCP attestation; time to contain; and the contagion cone — revoke an agent and quarantine everything downstream that acted on its output. The Onboard agent flow lets you pick a division or create a new one. Figures here are seeded to demonstrate the design; in production the plane reads your live fleet. Nothing is written from this preview.