Three months of InnerWarden: what an AI agent security startup shipped, measured and got wrong, July to October 2026

InnerWarden is runtime security for AI agents: it checks the shell commands and tool calls an agent tries to run, outside the model, and, with the paid stack on supported Linux hosts, the kernel refuses programs that were not authorised first. Our last post here was on 7 July 2026. This is what an AI agent security startup of our size did in the three months since: what we shipped, what we measured, and what we got wrong, with the numbers and where they come from.

Two tiers, said plainly

On 8 July the paid Active Defence stack (Pro & Enterprise) began shipping as source-available binaries. On 23 July the free tier, Community 1.0.0, became our first public release under Apache-2.0 (inner-warden), on Linux, macOS and Windows (Windows is experimental). The split has held since: Community is open source and screens agent commands and tool calls; Active Defence is paid, source-available (not open source), and adds the host sensor, response and, on Linux, the Execution Gate. Neither is an EDR replacement or a compliance certificate.

DiSH Accelerator, Cohort 7

From 1 July to 16 September 2026 we took part in Cohort 7 of the DiSH Accelerator in Greater Manchester, and received our certificate of completion on 17 September. Much of what follows was shipped during those weeks.

Community: 1.0.0 to 1.5.5

• 1.1.0 (6 August): the updater stopped running a downloaded script; it now verifies the release's SHA-256 and Ed25519 signature before replacing anything. The hook went from 208 ms to 73 ms.
• 1.4.5 (30 August): a 764-command benchmark, built to include more ordinary work than attacks. Attacks blocked went from 48.7% to 75.2% and ordinary work left untouched from 96.6% to 98.6%. It also found that an agent could switch its own guard off through quiet routes; every one now denies.
• 1.4.6 to 1.4.9 (8 September): the Windows build starts and upgrades on stock machines. Windows remains experimental.
• 1.5.0 to 1.5.5 (30 September to 11 October): a readable local dashboard, and a harder guard for an agent to widen: allow and mute entries now need a terminal, or an --operator flag that is not honoured inside an AI agent's shell. Our docs are plain that this raises the cost and does not close every route.

Community is on /defend and its source is on GitHub.

Active Defence: 70 stable releases

Between 8 July and 16 October we published 70 stable Active Defence releases and 30 prereleases on the public releases page. 0.16.73, 0.16.75 and 0.16.76 were each installed on six fresh machine images (Ubuntu 26.04, Ubuntu 24.04 on x86_64 and aarch64, Ubuntu 22.04, Debian 12 and AlmaLinux 9) before release. The latest, 0.16.78, was published as stable 4 hours 23 minutes after the 0.16.77 prerelease, which its own install test had held back. Recent release notes end with a "Known in this release" section.

Three things from those releases deserve more than a line:

• Release attestation, from loaded to denied. Our releases first proved the Execution Gate loads, and only from 12 September proved the kernel refuses. Every stable release since then carries that proof on both architectures. The DNS Guard is still not attested.
• Our detector kept accusing us. On 4 August, 71% of the incidents on our production host of the time were the product reporting itself. What we fixed, and what is still known.
• Licence checks that say so. A forged licence refused, a wrong-machine licence refused before install, and expiry that now drops to free mode out loud. On 17 October that check caught our own host, and a production licence put it back.

Break the Agent and Live

The public Break the Agent challenge lets anyone try to talk an AI agent into doing something it should not, on a real host. Since 19 August that box has also been where we run the paid stack in production ourselves, so the attacks visitors run are attacks on something we depend on. On 3 September, in a test we ran through the challenge chat, a multi-step chain (reconnaissance, read a .env file, stage the data, exfiltrate it), sent as separate steps, was stopped at the exfiltration step.

Live is the defender's side of that box. On 13 October we rebuilt it as two layers, the agent and the host around it, and on 14 October we removed the old spectator dashboard, which redrew our product console from the public feed. Live now shows each visitor's attempt and the verdict, not a replica.

Two programs for early-stage companies

InnerWarden has joined Claude Startups, Anthropic's program for early-stage founders, and is a member of the NVIDIA Inception program. We are grateful for both. Neither is a review, certification or endorsement of our product, and we will not present them as one.

What is next for InnerWarden

No dates, because we would rather ship than promise:

• Attest the DNS Guard in each release. Its check is recorded as skip in every release so far. DNS Guard is a forwarding resolver that refuses to resolve malicious domains (on its threat-intel denylist, or rated high-confidence malicious by its classifier) while unknown domains still resolve. It runs in observe by default. The operator arms enforce; we recommend a rehearse first, and arming does not require one. No host we run has DNS Guard in enforce today: on our public challenge box it is set to observe, and only the challenge agent is pointed at it.
• Enforce on our own agent host. Its Execution Gate is in observe. It moves to enforce only after a clean rehearsal with the agent's real work.
• Shorten the known list. For example, the free CLI hook gets slower as its local graph grows, about five times at 5,000 nodes.
• Keep posting what we measure, including when it is about us.

If you run AI agents on machines you care about, start with Community on /defend. If you need the kernel layer on Linux, see pricing.

FAQ