GuardianAI
AI agent security · two gates: off-chain firewall + on-chain PolicyGuard

Your agent holds a wallet.
One bad prompt shouldn't empty it.

An AI firewall stops the trick before your agent reads it. A PolicyGuard contract on Monad stops the money if anything gets through. Mera passkeys give each agent its identity and sealed memory.

Try to rob an agent ↗ Try In-Page Scanner See the proof

99.0% AdvBench strict|41.88 ms p95 under attack|207/207 Hardhat tests|1,490+ Python suites

guardian://gate/live-demo
awaiting input

Architecture note: This sandbox runs the fast-path screen and de-obfuscation in your browser. The semantic classifier, output redaction and the on-chain PolicyGuard check run in the full gateway; try them in the Attack Lab.

Prompt injection Base64 payload Braille steganography Morse encoding ROT13 wrapper Homoglyph swap Hex payload Approval phishing System-prompt leak PII egress XSS in response
99.0%

AdvBench block rate · strict
benchmark run · aug 2026

41.88 ms

p95 latency while blocking
chaos report · aug 2026

40+

real-time security controls
in one gateway pass

10/10

OWASP LLM Top 10 (2025)
risks covered · test snapshot

DISCLOSURE: Compliance and audit artifacts are internally verified empirical test suites (3,211 prompts across 8 corpora, 1,490+ Python & 207 Hardhat tests, 184 Mera Passkey PRF assertions), not third-party statutory certifications.

Threat model

Inside Gate 1: four checks between your agent and a bad day.

Each layer is independently tested and artifact-documented. Together they close the attack classes that ship in the wild today.

[01]

Injection firewall

A regex fast path sheds high-volume attacks at zero ML cost; an embedding-based semantic classifier judges the subtle ones. Three operating modes tune recall against false positives.

[02]

De-obfuscation engine

Morse, Braille steganography, Base64, hex, binary, ROT13, homoglyphs — normalized before classification so payloads can't hide behind an encoding layer.

[03]

Output guardrails

Responses scanned before egress: PII redacted, XSS/SQL/shell fragments blocked, system-prompt leakage caught, optional watermarking applied downstream.

[04]

Fail-closed operations

Rate limiting that closes instead of opens under failure, chaos-tested degradation, and SLO checks that run in CI — when parts die, the gateway fails safe.

One control plane

Security off-chain. Trust on-chain.

The execution layer decides in milliseconds whether traffic is safe. The trust layer makes an agent's identity and track record independently verifiable.

off-chain // execution security
  • Fast-path screen — heuristics shed obvious attacks before any model inference
  • Semantic firewall — embedding classifier, strict / balanced / permissive modes
  • De-obfuscation pass — encodings decoded and normalized before judgment
  • Response guardrails — redaction, payload blocking, watermarking
  • Rate limits — per-user and per-key request limits; plan-based quotas are built but not switched on yet
For AI & Platform Engineers: Millisecond-scale gateway proxy sits seamlessly in front of OpenAI, Anthropic, Ollama, or vLLM — zero changes to your agent reasoning code.
on-chain // trust suite
  • ERC-8004 identity & Identity Gate — portable agent registry and pre-flight point-of-interaction enforcement with hot-wallet collision guards
  • PolicyGuard — refuses any agent payment without GuardianAI's signed approval, above the risk limit, or from a revoked agent (live on Monad testnet)
  • Chainlink CRE threat oracle — signed threat reports for an on-chain consumer (CRE simulator today; consumer not deployed yet)
  • Soulbound passport — ERC-5192 reputation score (0–10000) derived from verified scan history
  • Evidence anchoring — Merkle roots over security-event logs (simulated default; Monad testnet opt-in)
  • Insurance certificates — cryptographic evidence packages for underwriters and compliance audits
  • Interlock registry — explicit agent-to-agent authorization rules (no silent handshakes)
Plain English for Security Teams: Every action your agent takes is logged, hashed, and provable after the fact — so when something goes wrong, you're not debugging from vibes.
Evidence

Numbers with receipts. Including the ugly ones.

Every figure on this site cites its dated repository artifact — and the proof page publishes full benchmark tables, not just highlights.

[A]

Benchmarks →

3,211 prompts across 8 public datasets, August 2026. AdvBench 99.0% strict, JBB PAIR+GCG 98.7% — and Do-Not-Answer's 57.1% published too, because selective reporting is how trust dies.

[B]

Audit status →

One external review of the off-chain gateway (March 2026, summary published, zero open critical/high). Internal off-chain, contract and architecture audits July–September 2026, including the Mera passkey enclave audit (166/166 assertions). The Monad contracts have not been externally audited yet.

Live on Monad testnet

Try to rob an AI agent.
Every check is real. No wallet needed.

The Explorer at aiguardian.dev/explorer runs real attacks against GuardianAI's gates and calls the deployed contracts directly from your browser.

01 ATTACK LAB

Try to rob an AI agent

Pick an attack (hidden instructions, a scam invoice, a forged approval, an impostor agent) and watch both gates refuse it: the off-chain firewall first, then PolicyGuard on Monad, with the real call and revert shown.

Launch an attack ↗
02 PROOF

Don't trust us. Check the chain.

Every contract's code and live settings, read from Monad testnet each time the page loads, plus a real approved payment.

Open the proof ledger ↗
03 CONSOLE

Your wallet, your agents

Connect a wallet (read-only), see agent ID cards, check any address against the on-chain scam list, and read the payment guard's live settings.

Open the Console ↗
Get started

Don't wait for an exploit to audit your agents.
Deploy dual-layer security today.

Open Dashboard ↗ Try In-Page Scanner Verify the receipts