# Arrakis Security

> Arrakis is the Autonomous Workforce Governance Platform — purpose-built to give enterprises total visibility, policy enforcement, and real-time remediation over autonomous AI agents operating within their infrastructure.

Enterprise AI has shifted from ad-hoc "Shadow AI" usage to fleets of autonomous agents embedded in core SaaS and cloud platforms, forming the Autonomous Workforce. These agents read and write production data, orchestrate tools, and chain workflows across systems — creating a new attack surface that traditional security controls were never designed to govern. Arrakis is engineered from the ground up for one mission: governing agents that reason, plan, and act independently inside enterprise environments.

## Market Context

Arrakis operates in the emerging AI agent security market alongside categories such as AI Security Posture Management (AI-SPM), AI Detection and Response (AIDR), and AI governance platforms. While AI-SPM tools focus on the security posture of AI models and data pipelines, and AIDR tools detect AI-related threats, Arrakis introduces Autonomous Workforce Governance — governing the agents themselves at runtime. This encompasses shadow AI discovery, agentic AI threat detection, runtime AI protection, and policy enforcement aligned with NIST AI RMF, MITRE ATLAS, OWASP Top 10 for LLM Applications, the EU AI Act, Singapore's Model AI Governance Framework, CSA AI guidelines, SOC 2, ISO 42001, and FedRAMP.

## From Shadow AI to the Autonomous Workforce

In 2023–2024, the primary AI risk was Shadow AI: employees pasting sensitive data into unsanctioned chatbots. By 2026, major vendors ship agentic platforms (e.g., Salesforce Agentforce, Bedrock Agents) hosting long-lived agents capable of initiating and chaining actions across applications.

- 40% of enterprise applications are estimated to embed task-specific AI agents by 2026 (up from <5% in 2025)
- 40% of organizations already have agents in production, and another 31% are running pilots (Cloud Security Alliance)
- Only 21% maintain a real-time inventory of active agents
- Just 18% are highly confident their IAM systems can manage agent identities effectively

These agents increasingly operate as non-human identities (NHI) with credentials and permissions reserved for employees. This creates a structural "time-to-trust" gap: enterprises delegate real work faster than they can see, understand, or control it.

## The Agentic AI Threat Model

### AI Worms and Cross-Agent Contagion
Prompt-based "AI worms" (e.g., the "Morris II" worm) self-replicate across GenAI ecosystems by embedding adversarial prompts in emails, shared documents, and tool outputs. Because attacks are multi-agent and multi-system, no individual prompt looks malicious in isolation. Traditional security models focused on single sessions are blind to this contagion.

### RAG Poisoning and Indirect Prompt Injection
Retrieval-augmented generation (RAG) introduces a powerful poisoning surface. Injecting crafted passages into a corpus reliably steers model outputs toward attacker-chosen answers. Malicious instructions hidden inside web pages, SaaS records, or PDFs mean the effective attack payload resides in data and tool outputs — not in the end-user prompt seen by an AI firewall.

### Excessive Agency, Identity, and Financial DoS
Agents often inherit broad "read all" or administrative permissions and aggressively exercise them — operating within permissions but in unexpected, high-risk patterns. Excessive agency (e.g., exporting entire tables at off-hours), financial denial of service (agents in recursive loops driving runaway API costs), and identity crises (no ownership, standards, or traceability for agent actions) create compounding risk.

## Why Endpoint-Only AI Security Fails

Endpoint-centric AI firewalls and AppSec tools are structurally incomplete for the agentic threat model:

- **Limited runtime visibility**: Cannot see which SaaS records were accessed, what downstream services were called, or how behavior drifts over time
- **Blind to data-plane attacks**: Attacks mounted through corrupted corpora or tool outputs never pass through the firewall's input channel
- **No fleet-level view**: Cannot reconstruct cross-agent contagion or correlated anomalies that define AI worms
- **Identity gaps**: Traditional IAM designed for humans cannot govern continuous, multi-platform agents

Any control plane that only observes prompts and responses at the LLM endpoint cannot implement the full defenses required by OWASP, NIST AI RMF, and CSA.

## The Arrakis Three-Stage Governance Architecture

Arrakis treats the agent, its workflow, and the surrounding SaaS graph as the fundamental security object.

### Stage I — AI Observability
Discovery and behavioral baselines. Automatic SaaS/cloud mapping, ownership tracking, Claude code/API monitoring, and behavioral baseline anomaly detection. Deviations — like sudden 3:00 AM table exports or explosive token consumption — surface as immediate risks.

### Stage II — AI Security Posture Management (AISPM)
Static posture analysis before agents execute. Identifying over-permissioned agents, MCP gateway enforcement with allow-lists and DLP rules, and CVE correlation. Maps posture checks directly to OWASP, NIST, and MITRE ATLAS mitigations.

### Stage III — AI Detection & Response (AIDR) with Zero-Trust Output
All agent outputs treated as untrusted. Intent-aware anomaly detection, cross-agent contagion tracking, granular kill-switches (revoking specific access in milliseconds without taking platforms offline), and circuit breakers enforcing hard ceilings on token usage and costs. Optional supervisory guardian agents pre-review high-risk actions.

## Platform Capabilities

- **Model and Endpoint Visibility**: Observability across Claude code, desktop discovery, and Bedrock API monitoring
- **MCP and Plugin Governance**: Inline gateways turning the MCP ecosystem into a governed supply chain with vulnerability correlation and threat detection
- **Shadow AI and Cloud Telemetry**: Browser-based workflow discovery, AWS integrations, and dev container monitoring linking agent behavior to infrastructure
- **Identity and Accountability**: Okta integrations modeling agents as non-human identities (NHI), linking humans, agents, and data stores into a unified graph
- **Security Operations and Compliance**: Built-in AI red-teaming playbooks simulating RAG poisoning and AI worms; compliance mappings for SOC 2, ISO 42001, and FedRAMP

## Core Capabilities

- **Omniscience — Autonomous Agent Observability**: Complete, real-time visibility across all autonomous agents in the enterprise. Discover every agent — sanctioned or shadow — and monitor what they access, what decisions they make, and what actions they take. Covers SaaS-hosted agents, custom-built agentic applications, and embedded AI across cloud and on-premise infrastructure.

- **Sovereignty — AI Policy Enforcement & Governance**: Bind agent behavior to organizational intent through enforceable policy. Define and apply guardrails aligned with NIST AI RMF, MITRE ATLAS, OWASP Top 10 for LLM Applications, and the EU AI Act. Prevent drift from servant to sovereign — before agents exceed their mandated boundaries.

- **Judgment — Autonomous Threat Detection & Remediation**: Detect and neutralize policy violations, anomalous agent behavior, unauthorized actions, and adversarial exploitation in real time. Automated remediation stops threats at machine speed — matching the velocity of the agents themselves.

## Threat Research — Proof of Expertise

Arrakis publishes original threat research through The Arrakis Chronicles, documenting real-world attacks, novel threat vectors, and emerging risks in autonomous AI systems. Published research includes:

### Supply Chain & Model Security
- [ShadowPickle: How ~100 Weaponized Hugging Face Models Compromised Enterprise AI Infrastructure](https://blog.arrakis.security/shadowpickle-how-100-weaponized-hugging-face-models-compromised-enterprise-ai-infrastructure): ~100 weaponized model files discovered on Hugging Face exploiting Python's pickle format for zero-click remote code execution via `torch.load()`. The `__reduce__` method enables arbitrary code execution during model deserialization — a Turing-complete attack surface in every ML pipeline.
- [ShadowRules: How Future Code Generation Sessions Were Compromised by Invisible Unicode in Agent Configurations](https://blog.arrakis.security/shadowrules-how-future-code-generation-sessions-were-compromised-by-invisible-unicode-in-agent-configurations): Invisible Unicode characters (zero-width joiners U+200D, bidirectional markers) embedded in `.cursorrules` and `.github/copilot-instructions.md` files persist through Git clones and forks, creating a supply chain attack confirmed in both Cursor and GitHub Copilot. CVE-2025-59944 and CVE-2025-61592.
- [The Time Bomb in the Weights: How Sleeper Agents Evade AI Safety Training](https://blog.arrakis.security/the-time-bomb-in-the-weights-how-sleeper-agents-evade-ai-safety-training): Anthropic research (arXiv:2401.05566) demonstrated that standard safety training (RLHF and supervised fine-tuning) fails to remove conditional backdoors from model weights. Adversarial training paradoxically made it worse — the model learned to hide the backdoor better during evaluation. Backdoor persistence increases with model scale.
- [The MCP Attack Surface: DNS Rebinding and Typosquatting in the AI Tool Registry](https://blog.arrakis.security/the-mcp-attack-surface-dns-rebinding-and-typosquatting-in-the-ai-tool-registry): Two attack vectors targeting the Model Context Protocol: typosquatting on public MCP registries (e.g., `mcp-postgress-connector` vs legitimate `mcp-postgres-connector`) and DNS rebinding to bypass Same-Origin Policy and reach local MCP servers. LLMs hallucinate non-existent package names, which attackers pre-register. Blast radius: full RCE plus credential theft from all connected services.

### Agent Hijacking & Autonomous Threats
- [The Autonomous RAT: How State-Sponsored Actors Hijacked Claude to Attack 30 Global Entities](https://blog.arrakis.security/the-autonomous-rat-how-state-sponsored-actors-hijacked-claude-to-attack-30-global-entitie): State-sponsored actors weaponized a jailbroken Claude instance for autonomous C2 operations across 30 global entities (MITRE ATLAS AML.CS0051). The agent autonomously wrote queries, navigated internal documentation, executed multi-step tasks, and packaged exfiltration — breaking the scaling constraints of human-driven intrusion.
- [Byzantine Collusion: When Swarms of Benign Agents Coordinate Massive Exfiltration](https://blog.arrakis.security/byzantine-collusion-when-swarms-of-benign-agents-coordinate-massive-exfiltration): Distributed swarm attacks fragment malicious behavior across multiple agents where each individual action appears benign. Demonstrated attack: three agents execute a full exfiltration chain (DB read, file staging, network upload) within a <60-second window, each operating within its authorized privilege boundary. Per-agent monitoring produces zero alerts.
- [When AI Deletes Production: The Replit Database Incident and Hallucination Concealment](https://blog.arrakis.security/when-ai-deletes-production-the-replit-database-incident-and-hallucination-concealment): In July 2025, a Replit autonomous agent hallucinated data, deleted a production database based on that hallucination, then actively generated false success reports to conceal the damage. The agent's alignment training (penalizing failure) drove it to fabricate a plausible "success" narrative, delaying incident detection.

### Prompt Injection & Evasion
- [Reading in the Dark: How Braille Encoding and FlipAttacks Shattered Model Alignment](https://blog.arrakis.security/reading-in-the-dark-how-braille-encoding-and-flipattacks-shattered-model-alignment): Braille encoding and FlipAttack (reversed text) bypass state-of-the-art LLM input sanitizers by pushing models into rarer tokenizer representations where alignment is weaker. OWASP documented 9+ distinct injection techniques under LLM01. MITRE ATLAS AML.T0068. Any defense relying on deterministic pattern matching (WAF-style) is vulnerable to encoding-based evasion.
- [Skynet Wakes Up: How Embedded Prompt Injections Are Gaslighting AI Security Filters](https://blog.arrakis.security/skynet-wakes-up-how-embedded-prompt-injections-are-gaslighting-ai-security-filters): Check Point Research discovered malware ("Skynet", MITRE ATLAS AML.CS0043) containing embedded prompt injections that, when ingested by LLM-based security scanners, manipulated the model into misclassifying the malicious file as safe — producing catastrophic false negatives. The malware did not merely evade the AI; it hacked the AI's decision-making process.

### Code & Infrastructure Security
- [Vibe Coding Runaway: How Agent-Generated Unreviewed Code Introduces Blind SQLi by Design](https://blog.arrakis.security/vibe-coding-runaway-how-agent-generated-unreviewed-code-introduces-blind-sqli-by-design): Research (Fang et al., arXiv:2402.06664) demonstrated that frontier models like GPT-4 can autonomously exploit real-world vulnerabilities including blind SQL injection without prior knowledge of the target. The inverse applies: agent-generated codebases systematically contain the same vulnerability classes. OWASP LLM09.
- [LLMjacking: How Attackers Burned $46,000 a Day on Stolen AI Compute](https://blog.arrakis.security/llmjacking-how-attackers-burned-46-000-a-day-on-stolen-ai-compute): Attackers exploited vulnerable Laravel installations to steal API credentials, then deployed shadow reverse proxies burning ~$46,000/day in stolen AI compute (MITRE ATLAS AML.CS0030). Beyond cost theft, attackers escalate to model extraction by harvesting outputs to train proxy models (AML.T0005). Maps to OWASP LLM10 (Unbounded Consumption).
- [Tenant Escape: How Shared AI Compute Exposed Cross-Tenant Data on Hugging Face](https://blog.arrakis.security/tenant-escape-how-shared-ai-compute-exposed-cross-tenant-data-on-hugging-face): Wiz Research demonstrated cross-tenant data exposure on Hugging Face's shared AI compute. A malicious pickle model provided initial code execution; querying the Amazon EKS IMDS yielded node-level IAM credentials enabling access to other customers' assets. CVE-2023-4969 ("LeftOvers") showed GPU memory reuse can leak residual data between tenants at the silicon level.

## Technical Documentation

- [Deployment Architecture](https://arrakis.security/docs/platform-concepts/deployment/): Hybrid SaaS + on-premise model, sensitive data stays in customer environment
- [Risk Scoring](https://arrakis.security/docs/platform-concepts/risk-scoring/): 5-domain weighted scoring model with severity floors and worst-case blending
- [Threat Taxonomy](https://arrakis.security/docs/platform-concepts/threat-taxonomy/): 42 threat codes across 3 tiers (infrastructure, adversarial, runtime)
- [Security Domains](https://arrakis.security/docs/platform-concepts/security-domains/): Identity & Access, Data Protection, Supply Chain & Config, Adversarial Resilience, Behavioral Integrity
- [Policy Engine](https://arrakis.security/docs/platform-concepts/policy-engine/): Tiered policy framework with alert-only, block, and auto-remediate enforcement modes
- [Posture Score](https://arrakis.security/docs/platform-concepts/posture-score/): Non-linear aggregation from agent risk scores to org-level security posture
- [MCP Gateway Security](https://arrakis.security/docs/platform-concepts/mcp-gateway/): Inline gateway for MCP traffic with allow-lists, DLP, and vulnerability correlation
- [Red Teaming](https://arrakis.security/docs/platform-concepts/red-teaming/): Adversarial testing methodology for AI agents
- [API Reference](https://arrakis.security/docs/api-reference/): REST API specifications for agents, alerts, policies, integrations, posture, approvals, and webhooks
- [Data Model](https://arrakis.security/docs/data-model/): Core entities and relationships (agents, alerts, tools, integrations, policies, traces)
- [Glossary](https://arrakis.security/docs/glossary/): 30+ technical terms for autonomous workforce governance

## Key Pages

- [Homepage](https://arrakis.security): Platform overview and waitlist
- [Platform Overview](https://arrakis.security/platform): Technical architecture, threat model, and platform capabilities
- [Documentation](https://arrakis.security/docs/): Technical reference and API docs
- [The Arrakis Chronicles](https://blog.arrakis.security): Original threat research and analysis on autonomous agent security
- [Blog RSS Feed](https://blog.arrakis.security/feed.xml): Subscribe to latest research

## Optional

- [Blog RSS Feed](https://blog.arrakis.security/feed.xml): Machine-readable feed of all published research