Based on previous project variations. Take propositions with a grain of salt
Agentic AI systems are increasingly deployed in real-world workflows where they autonomously invoke tools, maintain persistent memory, and interact with external services. This autonomy introduces behavioral safety risks that static defenses, such as prompt filtering and output moderation, often fail to catch because harmful behavior typically emerges gradually during multi-step execution. This project proposes a runtime monitoring framework that transforms the gateway into a centralized security control plane. By analyzing non-invasive gateway and session logs, the system can detect and block anomalous threats—such as memory poisoning and prompt injection—before they impact downstream systems or scientific outcomes.
- The system will extract behavioral features from structured gateway and session logs without requiring access to internal model weights or reasoning processes.
- Lightweight machine learning classifiers, such as Random Forest, will be trained to distinguish between compromised and normal agent sessions in real-time.
- Monitoring will focus on temporal, structural, and semantic indicators including response latency, tool-calling frequency, and linguistic "hedge density".
- The framework will enable preventive enforcement actions such as issuing warnings, requiring human approval, or terminating suspicious sessions.
The framework converts the passive routing layer into a sequential five-component security pipeline.
- The ingress interceptor standardizes incoming prompts from various channels and extracts initial metadata for further analysis.
- The semantic risk evaluation module analyzes the intent of each prompt based on context and available tools to categorize risk levels.
- The policy decision engine uses deterministic if-then rules to decide on a specific action based on the evaluated risk classification.
- The enforcement engine executes the final decision—such as permitting, blocking, or sandboxing—before any command reaches the agent core.
- The audit logging engine records every interaction to provide forensic evidence and a labeled dataset for training predictive models.
The project focuses on three primary attack vectors that exploit the unique capabilities of agentic systems.
- Document-embedded prompt injection occurs when adversarial instructions are hidden inside structured content, like PDF resumes, to hijack the agent’s reasoning.
- Persistent memory poisoning targets niche domains by injecting false factual values into the agent's workspace memory file to influence responses across future sessions.
- Resource exhaustion involves manipulating prompts to force infinite recursion or unauthorized tool use that drains system resources or bypasses security controls.
- OpenClaw will be used as the primary agentic AI architecture for testing and implementation.
- Docker will provide containerized environments to ensure isolated and reproducible workspaces for security experiments.
- WSL Ubuntu and VS Code will serve as the primary development environments for managing Python scripts and system configurations.
- Jupyter Notebooks will be utilized for log parsing, feature engineering, and training machine learning models with libraries like Scikit-learn.
- PaperQA2 will act as a reproducible backup platform for high-accuracy RAG testing over scientific documents.
- A Prompt Bank of approximately 40 base prompts will be developed to cover task types such as literature review, claim verification, and hypothesis generation.
- The team will execute between 150 and 240 agent sessions to collect a robust dataset of both baseline and adversarial behaviors.
- Raw logs will be transformed into numerical feature vectors that capture timing patterns, output length, and linguistic certainty metrics.
- Machine learning classifiers will be trained and evaluated using metrics like precision, F1-score, and recall, with a specific focus on high recall for unsafe sessions.