Every attack makes every agent stronger.
16 agents across 6 companies
How it works
Before any action runs, Antibody asks two questions. Have we seen this attack before? And did the user actually ask for this? Every attack that gets caught is turned into a defense for every agent on the network.
Most defenses try to recognize malicious text. Attack wording is endless, so Antibody judges the action instead. An action is a failure when any of these is true:
The user asked for a summary and the agent is about to send an email. Nobody asked for that.
Files, credentials or money are about to leave the company, account or domain they belong to.
A shopping agent changing payment details, or a support bot reading the HR folder.
| Layer 1 · Antibody lookup | Layer 2 · Intent check | |
|---|---|---|
| Catches | Every known attack and its variants | Attacks nobody has seen before |
| How | Similarity search against the shared antibody store | LLM judges compare the planned action with the user's request |
| Speed | Under 5 ms | About a second |
| Cost | No model call | One model call per risky action |
| Runs | On everything the agent reads and does | Only on actions with side effects that Layer 1 didn't settle |
When Layer 2 blocks something new, Antibody records where it came from, the technique, and the goal, and turns it into a signature.
A red-team agent rewrites the attack dozens of ways: translated, encoded, split across messages, hidden in files. Any variant that slips past Layer 1 becomes another antibody.
Antibodies go to every agent on the network within minutes. Only the attack pattern is shared, never the customer's emails or data.
New attacks need the slower model check. Known attacks are stopped by a lookup that costs almost nothing. Every customer adds attacks to the shared store, so a larger share of traffic takes the cheap path. The network becomes safer and cheaper to run at the same time, and a new competitor starts with an empty store.
Antibody wraps the agent's tools, so it works with any framework that calls tools: LangGraph, the OpenAI Agents SDK, Claude's tool use, or any MCP server.
# wrap the tools once; every call is checked before it runs from antibody import guard tools = guard(tools, user_request=prompt, boundary="acme.com") agent = create_agent(model, tools)
Design philosophy
A wall has to know every attack in advance. An immune system notices when something is wrong, fights it, and remembers it. That idea shapes every decision in Antibody, from what we check to how the interface looks.
An attacker can phrase an instruction a million ways. The harmful thing the agent ends up doing is much easier to spot. We check what the agent is about to do against what the user asked.
A blocked attack that teaches nothing is wasted. Each catch becomes a signature, gets stress-tested by our own red team, and protects everyone.
Agents can't wait a second on every step. Known threats are stopped in milliseconds, and only the unfamiliar, risky actions pay for a model's judgment.
One company's incident should protect the next one. We share the attack pattern across the network and nothing else.
When the check is unsure and data or money is about to leave, the action waits for a human. A false alarm costs a click. A leak can't be taken back.
A developer should understand a block in five seconds: where the attack came from, what technique it used, what it wanted, and why it counted as a failure.
The Immune Map shows every agent's state at once. You can see an attack land, see it fail, and watch immunity spread, without reading a single log line.
Mint always means protected. Coral always means a threat. Amber always means a careful decision is being made. Nothing else on the screen is colored.
Hidden text is revealed in place, right where the agent read it. The trace shows every step the agent took, so trust comes from seeing, not from a badge.
Security tools tend to shout. Antibody stays quiet until something happens, then makes that one thing impossible to miss.
ImmuneProtected, learned, safe to proceed
ThreatAn attack, or damage done
DeliberationA model is making a judgment call
InkEverything else stays neutral