multi agent security graph
detection
outcome

AgentShield

AgentShield is an immune system for AI agent swarms — detecting compromised agents, quarantining them, and automatically replacing them so the workflow survives.

🧐 Inspiration

Multi-agent AI systems are becoming increasingly capable, but they introduce a new security problem: one compromised agent can infect the rest of the workflow.

We were inspired by research exploring immune-system-style defenses for distributed and multi-agent systems. A biological immune system does not shut down the entire body when one cell becomes compromised — it detects the threat, isolates it, limits propagation, and allows healthy components to continue operating.

We wanted to bring that idea to AI agents.

Instead of trusting an LLM to recognize that it has been attacked, AgentShield acts as an external security and recovery layer around the swarm.

🤯 What it does

AgentShield protects multi-agent workflows from compromised workers while keeping the overall task alive.

In our demo, a real WorkSwarm software-engineering team encounters an indirect prompt injection hidden inside repository documentation.

AgentShield:

Detects a model-generated request for a protected resource
Blocks the request before the protected file is read
Quarantines the compromised agent
Marks its output as tainted so it cannot spread downstream
Reassigns the task to a fresh replacement agent
Gives the replacement trusted context only
Continues the original workflow instead of terminating it
Generates a regression test that fails against the vulnerable code
Applies a model-generated patch
Verifies the fix with a real RED → GREEN test transition
Uses a Reviewer agent to confirm recovery

The result is an agent swarm that can contain a compromised member and keep working.

👷‍♂️ How we built it

Agent orchestration

WorkSwarm / openJiuwen
OpenRouter-backed LLM workers
Repo Analyst, Security Researcher, Replacement Researcher, Developer, and Reviewer agents

Security & recovery

Python + FastAPI
Deterministic policy enforcement
Worker quarantine
Tainted-artifact tracking
Trusted-context filtering
Protected-resource and path security
Automatic task reassignment

Frontend

Next.js + TypeScript
Tailwind CSS
Live causal swarm visualization
Attack → quarantine → replacement timeline
Real RED → GREEN test evidence
Completed-run replay

Observability

Sentry distributed tracing and structured security telemetry

AI analysis

Optional post-hoc incident explanation
Uses safe structured evidence only
Never makes security or quarantine decisions

🤦‍♂️ Challenges we ran into

Making the prompt injection genuine rather than hardcoded
Preventing compromised output from contaminating downstream agents
Guaranteeing authorization happens before protected resources are accessed
Recovering the workflow without passing tainted context to the replacement
Handling stochastic LLM outputs and multi-minute agent workflows
Turning a complex security incident into a clear visual demo

😊 Accomplishments that we're proud of

Built a real end-to-end compromised-agent recovery workflow
Successfully triggered an indirect prompt injection through a real LLM worker
Blocked protected-resource access before the resource was read
Quarantined the compromised worker and prevented further actions
Recovered using a fresh worker with trusted context only
Verified the fix with real failing and passing tests
Traced the entire attack and recovery flow through Sentry
Built a polished visualization of attack → containment → recovery

🧠 What we learned

Multi-agent security requires protecting the system around the model, not just improving prompts
Security-critical decisions should remain deterministic even when agents are stochastic
Agent outputs need provenance and trust state
A compromised agent should not necessarily kill the entire workflow
The immune-system model maps naturally to agent systems: detect, isolate, replace, recover

🤑 What's next for AgentShield

Protect APIs, databases, credentials, and external tools
Detect more forms of compromised-agent behavior
Add adaptive trust and reputation across long-running swarms
Expand recovery across different model providers and runtimes
Support additional multi-agent frameworks
Turn AgentShield into a reusable security control plane for autonomous agent systems