Agentic AI
Archestra's OpenAPPA Blocks All Attacks on Agent Security Benchmarks
An open-source security framework for AI agents claims zero attack success on two major benchmarks by enforcing permissions outside the model's control loop.
InfoQ
Archestra has unveiled OpenAPPA, an open-source security framework designed to prevent data leakage in AI agents caused by prompt injection or model hallucination. Rather than relying on the agent itself to enforce rules, OpenAPPA operates independently, intercepting and validating every action the agent attempts to take.
The Problem with Probabilistic Security#
Most AI security systems today ask a second model to review each action the agent takes—similar to Claude Code's auto mode or Microsoft FIDES. But this approach has a fundamental flaw: it cannot track how data flows across multiple steps. Because these reviewing models are themselves vulnerable to prompt injection, they don't even see the actual data being handled.
More critically, probabilistic approaches have a statistical ceiling. Even systems claiming 99.3% accuracy fail at scale; across millions of calls, that remaining 0.7% translates to numerous breaches.
How OpenAPPA Works#
OpenAPPA implements what Archestra calls an Agentic Permissions Policy Algebra (APPA), described in a peer-reviewed paper. The system uses a single configuration file to define:
- Data sources and audiences — who is authorized to see what information
- Trust levels — whether data comes from verified or suspicious origins
- Authorities — which requests require human approval
Each tool the agent can call gets three attributes:
requires— who can use this tool and under what conditionsdelta— how using the tool changes data restrictionseffects— a log of successful actions
Labels work like a ratcheting lock: they can only become more restrictive. If an agent reads internal company data, subsequent operations are restricted to use only within the internal audience. If it fetches data from the web (marked as untrusted), that data cannot be used for sensitive operations like database changes.
Recovery and Real-World Utility#
When an agent tries to perform a forbidden action, OpenAPPA doesn't simply block it. Instead, it offers structured recovery paths:
