BYSS Labs · Technical brief

One decision.
Five gates.

AI agent security, one decision at a time. An agent you cannot trust asks to isolate a production machine. Deterministic code decides whether it is allowed to — and issues a receipt you can verify without trusting us either.

Lire ce dossier en français

This is not antivirus software.

Antivirus software detects malicious code on a machine. AEGIS detects nothing. It sits one layer above: between an artificial intelligence that proposes a containment action and an infrastructure that can be modified. It decides whether the action is allowed to execute, and produces proof of what actually happened.

Measured, not estimated

specification vectors reproduced byte for byte by a second implementation

npm run verifier:check

policy disagreements found across 15,000 edge cases, then fixed

differential tests

818/s

sustained mutations, p95 execution at 15.6 ms

npm run load:campaign

0.15.0

published release: signed tag, two reversible actions, receipts in SCITT format, SBOM digest in every receipt, public site assembled from the repository, MAIVAR snapshot roots anchored in the ledger

git tag -v v0.15.0 · CHANGELOG.md

Each value comes with the command that reproduces it, on a workstation, with no paid API, no cloud, and no cluster.

The brief, section by section

Eleven sections. Skim them collapsed; expand one to check the evidence.

Open only what is relevant to you. Each section makes sense collapsed; open, it gives the mechanism, the measurement, and the scope in the same place — what it claims comes with what lets you check it.

An AI security agent detects a compromised machine. It wants to isolate it from the network before the attack spreads. Three questions then arise, and the market does not answer them.

Do we let it act? If so, an AI that gets it wrong can take production down. If not, the human becomes the bottleneck again and the automation is pointless.
How do we know what it actually did? Logs are written by the system you are questioning. A log can lie.
Who brings the machine back online? An isolation you forget to lift is an outage you have inflicted on yourself.

AEGIS answers all three with a single mechanism. It detects nothing: it decides whether the action proposed by an agent you cannot trust is allowed to execute, and proves what happened.

Where it stands

A lab project, with a level of proof no one else in the category offers.

A second implementation that shares no line of code with the first. A formal model verified by bounded exhaustive exploration, and real traces replayed against it. Guardrails broken on purpose to check that a test fails. A receipt in IETF format, read back by libraries that have never seen the encoder, and a ledger that anyone can query without an account. Most of the players identified in this category have none of this — many are observability layers that describe without being able to prove.

The scope, in one sentence: a local lab, two actions qualified on a disposable cluster, keys held locally, an independent audit as the next step. What separates this lab from a deployment is not technical: it is a pilot, and it starts without modifying anything.

See the demo and the documents on the AEGIS Control site Back to BYSS Labs

Pilot

Pilots start in observation mode: AEGIS issues a signed receipt for what it would have done, without changing anything.

Talk to us

One decision.Five gates.

Eleven sections. Skim them collapsed; expand one to check the evidence.

01The problem, without the jargonA security AI detects a compromised machine and wants to isolate it. Three questions arise, and none of them has a good answer today.+

02The right analogy: the payment terminalA card payment terminal does not try to find out whether you are honest. That is precisely why it works.+

03The five gates, step by stepMission, evidence, validation, execution, restoration. Each gate produces a signed artifact and refuses something specific.+

04The tools, explained one by oneAbout fifteen technologies. What each one does, and above all what breaks without it.+

05How we know the code does what it saysIndependent verifier, formal model, differential tests, mutation tests, read-back by third-party libraries. Each method caught a real defect that conventional tests let through.+

06Who it is for, and howSix profiles, with what each one does in practice and where it stands.+

07Where it fits: 402 vendors, five layersAI investigation vendors have raised hundreds of millions, and their agents stop before acting. AEGIS fills that gap.+

08The regulatory timeline, and what AEGIS brings to itThe “high-risk” regime was postponed to December 2027 by the Digital Omnibus. What still applies, and what that changes.+

09The scope, written by the code itselfEvery run writes its own assurance case: seven claims with their status, eight named residual risks. The assessor does not guess the scope; they read it.+

10MAIVAR, the companion that recordsAEGIS decides, but detects nothing: it needs findings from elsewhere. MAIVAR reads the state of a Windows machine without writing anything to it, and anchors the root of every snapshot in the AEGIS transparency log.+

11How to verify it yourselfEight commands, no paid API, no cloud, no cluster. The longest takes about five minutes.+

A lab project, with a level of proof no one else in the category offers.

Pilots start in observation mode: AEGIS issues a signed receipt for what it would have done, without changing anything.

One decision.
Five gates.