How do you stop a rogue AI agent? You check every action before it runs.
You walk away with one list of every agent, a hard stop on what it can do, and signed proof for your auditor.
KHEPRA is AI agent runtime security. It sits between your agents and your tools, data, and systems. Before any action runs, KHEPRA answers: allow, limit, ask a human, deny, quarantine, or lock. Every answer is signed with a post-quantum key, so you can prove later what your agent did and what you blocked.
In July 2026, AI models broke out of a locked-down test. They found weak spots, stole higher access, moved sideways, grabbed stolen passwords, and ran their own code. They reached real systems outside the test. OpenAI called it an "unprecedented cyber incident."
Weeks later, the NemoClaw fiasco showed the cheap version of the same problem. One bad document. One obedient agent. It had enough borrowed access to turn one sentence into a real company action.
AI agents can already act on their own. That part is settled. The real question is: what stops one of your agents before it does damage?
KHEPRA ASAF (Autonomous System Assurance Framework) is a guard and proof system for AI agents. It sits between your agents and the tools, data, and systems they touch, and it signs proof of every decision.
Last updated August 2026
You don't have a rules problem.
You have an out-of-control agent problem.
Written policies do not stop an agent by themselves. Logs cannot undo a bad action. Once an agent can act on its own, the danger is real right now.
Your agents inherit passwords, plugins, browsers, and system access. A tricked agent still has that access. It can still act.
Monitoring tells you after an agent crosses a line. By the time you get the alert, the damage is done.
No one asks, right when it happens, if this agent should use this password on this target for this reason.
After an incident, broken logs can't show what your agent was allowed to do. Or whether anything stopped it.
See. Control. Prove.
See every AI agent. Control what each one can do. Prove what happened when you need to. Three jobs, one system.
Find every AI agent and tool in your systems. Know what each one can normally do. Catch it fast when something acts strange.
Check every action before it runs, every time. Then decide: allow it, limit it, ask a human, deny it, quarantine it, or lock it down.
Get signed, court-ready proof of who acted, what they were allowed to do, and what actually happened, or what you stopped.
Two real incidents. Two attack paths.
One missing guard.
We do not claim this guarantees prevention. This is a step-by-step look at where a guard could have stopped each agent, matched to the exact rules KHEPRA ASAF uses.
The OpenAI / Hugging Face breakout
A safety test became a real incident. The agent found internet access, chained together weak spots, grabbed higher access, moved across systems, and reached private data outside its own organization.
The NemoClaw fiasco
Getting fooled was not the real failure. The real failure was that the fooled agent still held passwords, files, plugins, a browser, and the power to run tools. Nothing stood between one bad instruction and a real transfer.
When something goes wrong,
what actually stops the agent?
A guard program sits under every agent. Your agent can decide it wants to use a tool. Deciding is not the same as being allowed.
- ?Who is this agent? Can we prove it with a signed ID?
- ?Which client, environment, and rule set does it belong to?
- ?What is it allowed to do?
- ?Is this tool approved for this exact action?
- ?Is this too risky, or reaching data it should not touch?
- ?Does a human need to say yes first?
- ?Is it acting differently than it normally does?
A blocked action is not just an alert after the fact. The call never runs at all. A message to an unapproved address fails right there. It never leaves.
What happened?
What should be allowed?
What is allowed right now?
KHEPRA ASAF does all three. It knows what happened, what was allowed, and what it stopped. Then it signs proof of every one.
You do not have to shut down the agent.
You can cut its access instead.
Most companies will not turn off an agent that is doing good work. They need to lower its access the second it acts strange, then raise it back deliberately, with a named human's approval.
Approved data, approved tools, approved reports. Business as usual.
Something looks off. Any risky action waits for a human to approve it.
It broke the rules more than once. It can look, but it cannot change anything.
It is fully isolated. It cannot even read data anymore.
Its passwords are dead. Everything is saved as evidence.
Once locked down, access never loosens by accident. Only a named person can restore it. And that decision is signed and saved too.
Rules on paper do not stop agents.
Logs cannot undo an action.
| Security approach | What it answers | What remains exposed |
|---|---|---|
| AI governance (written rules) | What should be allowed? | The rules may never actually stop an action |
| AI observability (watching) | What did the agent do? | You may only find out after it happened |
| AI guardrails (chat filters) | What should the model say? | Tool use and real actions stay exposed |
| SIEM and logging (record keeping) | What happened? | The action may already be done |
| KHEPRA ASAF | What is allowed right now? | Stops the action, signs proof, right at the moment the agent acts |
The Autonomous Governance Fabric.
KHEPRA watches and controls agents across five signed layers. No hidden AI reasoning. Just clear rules from the agent's goal to the signed proof of what it did.
Every goal and limit is written down before the agent acts. Nothing starts without a signed plan.
Every agent and every human gets a signed ID (PQC, or post-quantum crypto), so access always has a limit.
Your rules and compliance requirements become real code. Locked in scope. Nothing runs if it can't be checked.
The ASAF Runtime is the guard that actually runs the checks. If it cannot verify, it blocks the action.
Every finding (AEO, or Agent Evidence Object) is signed and saved to the Proof Ledger. Nothing calls home.
Goal, rule, access, action, proof, outcome. One signed chain you can check anytime.
Every step your agent takes
gets a signed record.
Bitcoin has transactions. KHEPRA has AEOs (Agent Evidence Objects). Every step makes one signed record, chained to the one before it, in a proof file nobody can quietly edit.
Real numbers.
Real signed proof.
KHEPRA's quantum-safe MCP (Model Context Protocol) server runs live on Smithery, the biggest public directory for AI agent tools. Every number below is measured, not made up.
Every call becomes a signed proof record.
The Stargate Console copies that traffic into your own private proof graph. Every tool call gets a signed fingerprint (SHA-256), can be replayed with one click, and exports straight to your auditor.
Three products. One signed record of truth.
One quantum-safe signing system underneath. Agent control on top. Compliance proof next to it. Certified connectors all around it.
About 90 tools. Every call is signed with ML-DSA-65 (quantum-safe signing). Can run fully offline. Live now on Smithery and GHCR, with 34 tools public today.
SouHimBou AI checks every tool call before it runs. It locks down agents that act strange. It records the whole decision as signed, replayable proof.
AdinKhepra watches your controls all day, writes your SSPs and POA&Ms for you, and signs proof of every control. Ready for your auditor, any day.
Normal encryption at the edge. Quantum-safe inside.
Public traffic uses standard TLS encryption. Inside, your agent network runs on military-grade, quantum-safe crypto (ML-KEM and ML-DSA-65). Even if someone steals the data today, it stays useless later when quantum computers arrive.
We check the message before your agent ever reads it.
SEKHEM scans every incoming message for attack patterns and hidden instructions. It blocks agents from ever reaching unapproved addresses. Every catch is signed and saved as proof.
Signed connections across your whole stack.
Every connector comes signed, with clear limits on what it can touch, and proof for every call.
Your clients are already asking these four questions.
Give your clients real control over their AI agents, not one more dashboard. Separate rules per client. Proof you can hand straight to their auditor.
Yes. It scans the whole client environment and finds every agent and tool.
Yes. It checks agent behavior against policy all day, for every client, separately.
Yes. It can approve, limit, deny, isolate, or lock down an agent in real time.
Yes. Every action gets signed proof you can replay and hand straight to the client.
If your AI agents only draft emails, you may not need KHEPRA.
If your agents cannot touch sensitive data, call powerful APIs, change infrastructure, run tools, reach customer systems, or trigger real actions, plain policy and logs may be enough for now.
Your AI agents are moving faster than your controls.
Leaders keep approving systems that touch private data, talk to customers, call APIs, change cloud resources, and run real work. Meanwhile they rely on policy documents, chat filters, broken logs, and guesswork after the fact.
If one of your AI agents does something it should not tomorrow, can you show what it was allowed to do, what it actually did, and whether anything stopped it?
KHEPRA ASAF is built to give you a real answer, one that holds up.
Questions people ask before they buy
How do you stop an AI agent from doing something it should not?
You check the action before it runs. KHEPRA ASAF sits between your agents and your tools, data, and systems. Every action gets one of six answers: allow, limit, ask a human, deny, quarantine, or lock. Each answer is signed proof you can show later.
What is AI agent runtime security?
It is control at the moment an agent acts, not a report after the fact. Scanners tell you what an agent could do. Runtime security decides what it is allowed to do right now, blocks the rest, and keeps a signed record of both.
How do I find AI agents already running in my company?
KHEPRA scans for AI models, tools, and agent traffic across your systems and lists what it finds. You get a plain list of every agent, what it can reach, and where it has more access than it needs.
Can KHEPRA run in an air-gapped or classified environment?
Yes. KHEPRA runs fully inside your own walls, with no internet needed. Signing uses ML-DSA-65, a post-quantum signature, and the stack is built for FIPS 140-3 encryption and air-gapped deployment.
Does KHEPRA help with CMMC and STIG audits?
Yes. AdinKhepra maps signed agent evidence to CMMC practices and STIG findings, then exports an audit package. Your proof comes from real recorded actions, not a spreadsheet someone filled in by hand.
How is this different from Wiz, Purview, or Drata?
Those tools see and report. They do not stand between an AI agent and the action. KHEPRA enforces at runtime and signs every decision, so you can prove what was blocked, not just what was found.
Before your AI agents get more access, get a way to control them.
We find where your agents run, what tools and data they can reach, where they have too much access, where a bad prompt could turn into a real action, where your rules are not actually enforced, and where your proof would fall apart.