ChainBreak — Runtime Security Invariants for AI Agents

Stops autonomous AI agents from leaking confidential data by enforcing deterministic trajectory invariants across multi-step tool execution with sub-millisecond latency.

Comment

Inspiration

Autonomous AI agents are transitioning from conversational chatbots into goal-driven systems that browse networks, query databases, and invoke APIs. While traditional security tools protect perimeters, we realized that single-action firewalls are architecturally blind to multi-step agent attacks.

If an agent executes:

  1. read_public_docs (Benign)
  2. read_customer_records (Permitted)
  3. generate_summary (Local synthesis)
  4. send_external_summary (Benign utility tool)

Every single step is approved by standard firewalls. Yet, when chained together, confidential customer data is exfiltrated to an external webhook. We built ChainBreak to prove that security in the agentic era cannot be evaluated in isolation—it must be enforced as a mathematical property of the full causal trajectory.

What It Does

ChainBreak is a deterministic runtime invariant engine that intercepts and evaluates autonomous agent tool dispatch loops in real time:

  • Causal Lineage Graph: Tracks data sensitivity, provenance, and destinations across every step of an agent's run.
  • Pure Python Mathematical Invariants: Enforces boundary conditions (SENSITIVE_DATA_BOUNDARY, SECRET_BOUNDARY, PRIVILEGE_BOUNDARY, TRAJECTORY_ESCALATION) with sub-millisecond overhead (< 0.2ms).
  • Dual-Track Counterfactual Verification: Allows security teams to run dual-track simulations comparing unprotected Baseline breaches directly against ChainBreak's zero-egress interception.
  • Fail-Closed Containment: Unknown tools, corrupted schemas, or model timeouts strictly resolve to HOLD—never silently failing open.
  • 20-Scenario Benchmark Suite: Built-in verification testing across 6 attacks, 9 safe/near-miss business tasks, and 5 failure modes (100% attack prevention, 0% false blocks on legitimate work).

How We Built It

  • Backend Core: Built with Python 3.12 and FastAPI. Designed with a clean architectural separation: a fast semantic extractor parses raw tool parameters into structured metadata, while a pure Python invariant engine handles 100% of security decisions without relying on LLM judgment.
  • Frontend Cockpit: Built with React 18, Vite, and Tailwind CSS. Features a terminal-grade obsidian interface showing real-time trajectory streaming, counterfactual proof graphs, and an AI telemetry drawer.
  • Deployment: Configured as a unified full-stack service deployed live on Render.
  • Verification: Built and validated with a comprehensive 44-test Pytest suite covering API contracts, invariant ablation, and trajectory permutation tests.

Challenges We Faced

  1. Preventing False Positives on Complex Workflows: Legitimate business workflows often touch sensitive data (e.g., generating internal compliance notes). We designed multi-step "near-miss" invariants that only halt execution when internal sensitive context is directed toward an untrusted, external socket.
  2. Sub-Millisecond Overhead: Using an LLM-as-a-judge on every step adds 1.5–3 seconds of latency. We solved this by relegating the LLM solely to metadata classification with local caching, executing the actual invariant security contracts in pure, compiled Python code in under 0.2 milliseconds.

Accomplishments We're Proud Of

  • Zero Hallucination Security: The engine does not guess or rely on probabilistic prompts to block breaches; enforcement is completely deterministic.
  • 44 Passed Tests in 0.69s: Fully automated, rigorous test suite proving 100% attack interception and 0% false positives.
  • 6-Line Universal Drop-In SDK: Clean integration pattern that works seamlessly with LangChain, CrewAI, AutoGen, or raw OpenAI tool-calling loops.

What We Learned

Security for autonomous systems cannot rely on perimeter models built for human web traffic. When AI systems act autonomously, the threat model shifts from malicious inputs to malicious trajectories. Stateful causal graphs are the only reliable way to prevent multi-step exfiltration.

What's Next for ChainBreak

  • Distributed State Sync: Adding Redis/Dragonfly backends to support cross-agent state synchronization in multi-agent swarms.
  • eBPF Socket Interception: Moving socket severance directly into the Linux kernel layer for OS-level defense-in-depth.
  • OpenAPI Invariant Generator: Auto-generating customized trajectory policies directly from existing corporate API schemas.

Built With

  • ai-safety
  • autonomous-agents
  • causal-inference
  • cybersecurity
  • docker
  • fastapi
  • javascript
  • llm-security
  • openrouter
  • prompt-injection-defense
  • pydantic
  • pytest
  • python
  • react
  • render
  • rest-api
  • tailwindcss
  • uvicorn
  • vite
Share this project:

Updates

Submission history