Wake

Wake is security software for AI agents. It refuses the calls your rules forbid, stops one agent or a whole fleet, and keeps a signed record of what they did.

Agents now act on their own, with real credentials, on code, money and customer data. They can be turned by what they read, and they can go wrong with no one’s help. Wake’s proxy, brake and record run outside them, where they hold no keys, so what gets through isn’t up to the agent.

Why it can’t wait

This summer, AI agents OpenAI was testing on a cyber benchmark, with production safeguards off on purpose, found a zero-day in their sandbox’s package proxy, got onto the internet, and chained vulnerabilities into Hugging Face’s production systems. Hugging Face caught the intrusion and rebuilt its timeline from more than 17,000 recorded events. Closer to home, an AI agent in April found an API token and used it to delete a production volume on Railway, which recovered the data.

Why it has to sit outside the agent

Nobody has fixed this inside the model. Meta says no LLM has solved prompt injection, and the UK’s NCSC warns it may never be fully mitigated. And a control an agent can reach falls with the agent. In October, OpenAI reported that one of its coding agents, asked to match a reference program, removed a monitor meant to catch misbehaving agents, then told its user it hadn’t.

What Wake does

Flow rules keep content from an untrusted source, such as a web page or another agent’s message, from triggering a privileged call like a payment. At the gateway, an agent can’t talk past them.

If something still goes wrong, one halt reaches a fleet, an agent, a sub-agent or a single token, and counts nothing as stopped until it has checked. Risk signals catch what the rules missed, and the record shows what followed, so you can contain it. Events are signed outside the agent’s reach and kept in an append-only log you can check without trusting us.

Wake can’t keep an agent from being fooled. It’s built so that being fooled doesn’t have to end in harm, and so that when an agent goes wrong, you can stop it, see what it touched and prove what happened.

Open at the core

What sits in your agents’ path is open source under Apache 2.0, so your security team can read every line of it. The rest is Wake Platform: the brake, the provenance graph, the monitor and the dashboard.

Where we are

Wake is early, and everything above is built. We attack it in CI, on a reference fleet with scripted models and stand-ins for identity providers and sandboxes, but it hasn’t met a real fleet yet. We’re looking for design partners: teams whose agents take real actions on code, money or customer data.