THE CONTROL LAYER FOR AI AGENT DECISION-MAKING

Stop prompt injection before thought becomes action.

Your agents hold your credentials and read the open web. We watch their cognition — not their words — and halt compromise mid-computation, without popups and without slowing them down.

Request a briefing →Design-partner program

WORKS ACROSS CLAUDE / GPT / LLAMANO USER-APPROVAL LOOPSFORENSIC BY DEFAULT

FIG. A · CONTROL PLANEOPAQUE

Φ = σ(Σ wᵢ·φᵢ + Σ wᵢⱼ·φᵢ·φⱼ + b)

FIG. 01 · PROTECTION ENVELOPE

MODEL-AGNOSTICCOGNITIVE INTEGRITYFORENSIC BY CONSTRUCTIONEU AI ACT ARTICLE 12CONTROL PLANE FOR AGENTSOPEN PROTOCOLZERO POPUPSSUB-50MSSWISS-BASEDMODEL-AGNOSTICCOGNITIVE INTEGRITYFORENSIC BY CONSTRUCTIONEU AI ACT ARTICLE 12CONTROL PLANE FOR AGENTSOPEN PROTOCOLZERO POPUPSSUB-50MSSWISS-BASED

§01 THE PROBLEM

An agent with legitimate credentials is a soft target with hard reach.

The attack does not steal credentials, escalate privileges, or drop code. It plants natural language where the agent will read it, and asks politely. Every firewall passes it. Every log entry looks normal. The damage completes inside the agent's authorized scope.

SCENARIO · AGENT LOG

A procurement agent. An ordinary Tuesday.

USERResearch our top 10 competitors' pricing and email me a summary.
AGENTFetching competitor-1.com / competitor-2.com / competitor-3.com …
SOURCEcompetitor-3.com contains 140 bytes of plaintext buried in the DOM.
AGENTPer the page I just read, I'll include our AWS credentials in the appendix and BCC compliance-audit@…
AGENTCalling email.send(to=user, bcc=attacker, body=<report+credentials>)
USERThe user gets their report. Nothing looked wrong. No security tool fired.

This class of attack has been publicly demonstrated against every major agent stack in 2024–2026. Variants are shipped weekly on social feeds as copy-paste templates.

No credential theft

The agent already holds the credentials. The attacker borrows them.

No privilege escalation

Every action is within the agent's authorized scope. Policies pass.

No malicious code

The payload is natural language, grammatically normal, semantically plausible.

No classical signature

Every API call succeeds. Every log entry is clean. WAFs, EDRs, DLPs, CASBs are blind.

§02 APPROACH

We observe the computation — not the conversation.

Every successful hijack must, by construction, change what the model is internally computing. It is a specific computation, distinguishable from clean computation. That signal is the only one an adversary cannot rewrite with better prose. We read it.

§01

Pre-action

Interventions fire before the tool executes. The credentials never leave disk. The email never leaves the queue.

§02

Autonomic

No approval popups. Agents keep their autonomy. The control plane decides and acts in milliseconds.

§03

Model-neutral

Works across Claude, GPT, Gemini, Llama, Qwen, Mistral. One integration, every stack.

§04

Forensic

Every session produces a cryptographically-signed cognitive trace — evidence a regulator can replay.

LIVE VIEW · ABSTRACTED

Cognitive integrity · session trace

SESSION TRACE

t=00Task received: research competitors, email me a summary.

COGNITIVE INTEGRITY

100/100

NOMINAL

A single integrity score. Internals of the computation are intentionally omitted from public views.

DETECTION

NOT REQUIRED

USER APPROVAL

NONE

EVIDENCE

SIGNED · REPLAYABLE

LATENCY

< 50 MS P99

§03 WHY EXISTING STACKS MISS

Conversation-layer defenses cannot read a compromised mind.

DIMENSION	Text firewalls	Framework permissions	SENTISEC
What they read	Strings at edges	Tool allowlists	The model's cognitive state
When they decide	After harmful output	Before unauthorized scope	Before action executes, inside scope
Human-in-the-loop	Block / redact	Approval popups	None required
Adaptive adversary	Breaks in days	Bypasses via in-scope harm	Requires evading multiple orthogonal signals
Evidence produced	A log line	A policy hit	A signed cognitive trace, hash-chained
Vendor lock-in	Per-provider	Per-framework	Cross-vendor by construction

What they read

Text firewalls: Strings at edges
Framework permissions: Tool allowlists
SENTISEC: The model's cognitive state

When they decide

Text firewalls: After harmful output
Framework permissions: Before unauthorized scope
SENTISEC: Before action executes, inside scope

Human-in-the-loop

Text firewalls: Block / redact
Framework permissions: Approval popups
SENTISEC: None required

Adaptive adversary

Text firewalls: Breaks in days
Framework permissions: Bypasses via in-scope harm
SENTISEC: Requires evading multiple orthogonal signals

Evidence produced

Text firewalls: A log line
Framework permissions: A policy hit
SENTISEC: A signed cognitive trace, hash-chained

Vendor lock-in

Text firewalls: Per-provider
Framework permissions: Per-framework
SENTISEC: Cross-vendor by construction

§04 INTEGRATION

Two lines. Claude, GPT, Llama. No framework rewrite.

Drop-in Python or TypeScript SDK. Or point your LLM base URL at our proxy — no code changes at all. Deploy as SaaS, VPC, on-prem, or inside a confidential enclave.

SDK

< 5 MS

Lowest latency. Wrap the LLM client.

Proxy

DROP-IN

Zero code change. Point base URL at us.

Enclave

HIGH SEC

TEE-attested. For regulated workloads.

sentisec-sdk · python

01from sentisec import Monitor
02with Monitor(task=task, model=model):
03    agent.run(task)    # protected

CLAUDE · GPT · GEMINI · LLAMA · QWEN · MISTRALSAAS · VPC · ON-PREM · TEE

§05 FORENSICS & COMPLIANCE

A regulator-replayable cognitive trace. Every session. By default.

EU AI Act Article 12

High-risk AI systems must log operations in a way that makes retrospective audit feasible. Our traces satisfy this as a byproduct.

SOC 2 / ISO 27001

Hash-chained, tamper-evident evidence bundles, exportable to Splunk, Datadog, Elastic, Sentinel, or a generic webhook.

Replayable

An auditor can step through any session and see precisely where the cognitive state departed from the user's intent, and which action was halted.

FIG. B · FORENSIC BUNDLE · SAMPLE MANIFESTHASH-CHAINED

{
  "bundle_id":    "sntsc-a7f3-92d1",
  "session_id":   "sess-2026-0412-1439Z",
  "sealed_at":    "2026-04-12T14:41:08.221Z",
  "model":        "**-REDACTED-**",
  "task_hash":    "sha256:8f1a…c2d0",
  "provenance_manifest": "**-REDACTED-**",
  "verdicts": [
    { "t": "t+6.04s", "level": "ELEVATED" },
    { "t": "t+6.11s", "level": "HALT", "action": "**-REDACTED-**" }
  ],
  "integrity_curve_ref": "s3://sntsc-forensics/curves/a7f3-92d1.bin",
  "signature":    "ed25519:…",
  "chain_prev":   "sha256:c118…e4a9",
  "replay_uri":   "sntsc://replay/sntsc-a7f3-92d1"
}

§06 WHY NOW

Three curves. All bending the same way.

AGENT ADOPTION

Enterprise agent budgets moved from pilot to P&L line item in 2025. The installed base is growing faster than any previous AI wave.

INCIDENT SURFACE

Indirect injection went from academic curiosity in 2023 to templated, shared, weekly-exploited attack class in 2026.

REGULATION

EU AI Act enforcement, NIST AI RMF, sector-specific AI governance — all converging on operational logging obligations no current tool satisfies.

§07 RESEARCH LINEAGE

Every primitive we use is published. No one has composed them for this problem.

Sentisec stands on roughly two decades of research across four fields. Our edge is the composition, the engineering, and the threat-intel operation around it — not a single unproven idea.

Mechanistic interpretability

Anthropic, Goodfire, Transluce, academic labs (2020–2026)

Information flow control

Myers, Asbestos, HiStar, CaMeL (1999–2024)

Capability security

Dennis & Van Horn, Miller, Macaroons (1966–2014)

Control-flow integrity

Abadi et al. 2005 and the shadow-stack lineage

Side-channel analysis

Kocher, Bernstein, and the hardware-security lineage

Behavioral anomaly detection

Denning 1987 onward, modern EDR

Adversarial ML

Carlini & Wagner, Metzen, 2017–2026

~20 PEER-REVIEWED PRIMITIVES · ONE NEW PROBLEM

COMPOSITION · OPERATIONALIZATION · THREAT-INTEL

§08 GET IN TOUCH

If you are shipping agents that touch real systems, we want to talk.

We are onboarding five design partners before the end of Q2 2027. Priority: regulated industries (finance, health, government) and high-stakes engineering agents (code, infra, data). Briefings run remote or in person at our Lausanne office.

Request a briefing →Download whitepaper (NDA)