AMES: keeping agents safe when someone is trying to misuse them
In short: AMES is the security layer of our research. It assumes every agent action could be manipulated, for example by prompt injection, and places seven independent checks between what an agent proposes and anything that commits. If any single check fails, the action stops (it does not go ahead on a majority vote) and goes to security review.
The question it answers: How does autonomous execution remain safe under adversarial pressure?
Seven independent checks.
| Check | What it ensures | Threat it addresses |
|---|---|---|
| Credential isolation | No payment or system keys ever appear in what an agent handles | Insecure credential handling |
| Tool allowlist | An agent can use only the tools approved for that task | Tool misuse |
| Delegation depth | Agents cannot hand work to other agents without limit | Runaway agent loops |
| Signed instructions | Instructions with real consequences must carry a valid signature | Direct and indirect prompt injection |
| Schema conformance | Output must match the exact expected format | Malformed or smuggled payloads |
| Tenant isolation | An action cannot touch another customer's data | Cross-tenant data leaks |
| Key separation | Settlement keys do not exist where the AI reasons | Key theft through the model |
The threat column follows the OWASP and MITRE categories named in the paper.
What the paper does not claim.
AMES does not promise to remove every vulnerability. It cannot catch an instruction that is perfectly well-formed but wrong in intent. The security bound holds only under stated assumptions, and its figures come from a disclosed simulation.
Where it shows up.
The security extension on Solutions, the risk-control table on How We Work, and "Do agents get access to our payment credentials or system keys?" on the FAQ.
Autonomous Micro-Enterprise Security (AMES)
How to cite: Rajagopal, R. K. (2026). Autonomous Micro-Enterprise Security (AMES). Secular Labs AME Architecture Series. https://doi.org/10.5281/zenodo.22718544
Frequently asked
Can prompt injection still get through?
An injected instruction would need to pass every independent check, and instructions with real consequences must be signed. AMES lowers the risk and contains it. It does not claim zero risk.