No. Every prompt and response is SHA-256 hashed at the moment of capture — the raw text is never written to disk, logs, or any database. AariaSec keeps behavioral fingerprints and metadata only, which is why it can run on sensitive workloads.

Behavior: which tools an agent calls, where it sends data, its timing and token rhythm, and how that compares to its own learned baseline. A tricked agent that still has your access looks wrong behaviorally long before any keyword filter would notice — that's the gap AariaSec closes.

Detection runs entirely on your device or server, and no prompt or response content ever leaves — that one is architectural, not a setting. One channel is on by default: anonymous, hash-only detection signatures that power collective defense — a single environment variable (AARIASEC_CONTRIBUTE_SIGNATURES=0) turns it off, and the app reports its own egress posture on the dashboard so you never have to take our word for it. Everything else — SIEM export, TAXII, webhooks, compliance bundles — stays off until you enable it.

It runs entirely on your machine and binds to localhost only — nothing of yours is sent to AariaSec. Your agents' requests still go to their normal destinations; AariaSec sits in the middle just long enough to compute a SHA-256 fingerprint, then drops the raw content. The TLS certificate authority is generated on your device and its private key never leaves the machine.

That was the most common objection we heard, and it was fair: an alert that says “baseline deviation, 4.7 sigma” has moved the decision onto the person least equipped to make it, and it gets overruled. So every alert now leads with one sentence, in three parts — what the agent did, what is normal for it, and what it was holding at the time. “This agent sent 5.7 MB to an address it has never used before. It normally sends about 2 MB, only to your GitHub. It is holding your AWS credentials.” No sigma, no jargon, and the last clause is the one that turns a metric into a decision. It is generated from templates over byte counts, hostnames and tool names — never from a model, so it cannot invent a consequence, and never from your prompts, which we do not have. It reaches the Slack message, the PagerDuty page, the Jira or ServiceNow ticket and the SIEM row, not just the dashboard — the ticket that lands in somebody’s queue is exactly where a verdict code is least useful. Two things we are deliberate about: when an agent is still learning there is no “normal” yet, so it says that rather than inventing a baseline; and when nothing the agent reaches matches a credential type we recognise, it says that is not the same as no exposure rather than implying an all-clear.

Yes. We're a firewall for actions, not addresses — a network firewall decides where an agent may connect, we decide what it may do, because we can read the tool call. On by default: a response that instructs your agent to call a destructive tool (delete_*, drop_*, wipe_*, and 17 more) gets a 403 before the agent ever receives it. At the kernel (Enterprise): an agent launched under AariaSec's scope lock runs inside Landlock+seccomp (Linux), Seatbelt (macOS), or AppContainer + Windows Filtering Platform (Windows) — stepping outside the sanctioned scope is refused by the kernel before it can happen, and fail-closed if the sandbox can't be established. Between watching and stopping: containment used to be all-or-nothing. You can now pin one agent's egress to an authorized exit, cap its bandwidth, or cut just the channel two coordinating agents share — both keep doing their real work while the shared channel closes. Without the certificate: a quarantined agent is refused at the connection itself, so containment works even in discover-only mode with nothing decrypted and no certificate installed. All three kernel tiers are now verified on real hardware — Windows completed its end-to-end run on 2026-09-12 (18 of 18 assertions, Windows 11 build 26100), which took six defects to reach, five in the product and one in the test harness itself. Four honest limits: the agent must be launched through AariaSec for scope lock, scope lock is Enterprise-only, proxy-level network containment fails open if its policy file is missing or corrupt, and bandwidth caps are applied by the proxy — there is no kernel-side shaping, so an agent that leaves the proxy is unshaped.

Only if you turn that on. AariaSec ships in observe / alert-only mode — it watches and scores, and takes no action on its own. Automatic containment is opt-in and per-agent, and any block is reversible.

Because we published the test. PRAMANA is an open benchmark that scores monitoring systems — not agents — on a corpus of behavioural traces containing no prompt text. We do not win every column: on season v3 our weakest attack class scores 0.71 recall, and a forty-line longitudinal baseline still beats us outright on one class. See the research section.

First, what that window is for. You never write detection rules for your agents. The deterministic library ships with 286 of them — 223 evaluate against the telemetry the sensor produces today, and the other 63 are authored ahead of the OS-layer signals they need and labelled as such, with zero advertised-but-unable-to-fire — and the behavioural layer learns each agent's own normal by watching it work — tool cadence, egress targets, timing. That is what the first three days are: not a gap in coverage, but the product learning your fleet so nobody has to sit down and describe, in advance, what a hundred different agents are each supposed to do. At the end of it AariaSec will draft the manifest for you from what it actually saw — the tools that agent really called, the destinations it really reached — and hand it back with the evidence behind it: how many events it was derived from, how confident that makes it, and whether that agent's baseline carries any poisoning risk. You review it and register it. It never registers itself, because a manifest written from observation would otherwise encode a compromise as policy if the agent was already compromised while being watched. Destructive patterns stay denied regardless of what was observed. Now the honest part, because the window does have real edges. The 3-day window narrows what's blind, it doesn't remove protection — the deterministic rule library needs no baseline and alerts from event one (credential exfiltration, SSRF to cloud metadata, destructive tool chains, anything outside a declared manifest); only the statistical anomaly comparison is undefined before a baseline exists, because there is nothing to compare against yet, not because it's switched off. Second, automated (added 2026-09-07): every completed baseline is scored for poisoning risk before its trust stamp issues — if the agent ALSO produced real detections (a CRITICAL/HIGH rule match, a manifest violation) during its own learning window, the baseline is flagged with the specific reason rather than silently trusted. This never blocks the transition — an attacker-controlled agent must not be able to lock itself out of ever being scored by triggering it deliberately — it flags the result for review instead. Third, rule-free (added 2026-09-11): the signals above all need something to have fired, so an attacker who stays under every threshold produced a clean window and still poisoned the baseline. That gap is now partly closed by a check that needs no rule at all. A settled baseline's novelty rate decays — an agent finds the handful of tools and destinations it actually needs, then repeats them. Enumeration has the opposite shape, because finding new things is the activity, so novelty never decays. We accumulate that persistence across the window and flag a baseline that never converged. Measured against synthetic traffic with known ground truth: sustained enumeration of three or more previously-unseen destinations per segment is caught every time, with no false positives across 400 normally-converging agents. The floor is real and we'd rather print it than imply we closed this: an attacker patient enough to stay at two or fewer new destinations per segment — roughly a dozen new hosts across a whole learning window — is still not caught. And because a legitimately expanding workload looks the same, the finding is "this baseline hasn't settled, don't trust it yet", never "this agent is malicious". What that limitation does and doesn't reach: a poisoned baseline blinds the statistical comparison to that one pattern going forward — it does not blind the engine. The deterministic rule library above still runs on every event regardless of baseline age or poisoning, so a credential exfil, an SSRF attempt, or a forbidden tool call still alerts on day 400 exactly as it would on day 1. Third: yes, you can also force a re-baseline manually — one API call (agents:write permission), any reason, whether that's a planned model upgrade or a baseline you no longer trust. The prior baseline is kept for comparison, not discarded, and forbidden-action alerts stay on through the whole re-learning window regardless.

Any agent that reaches an LLM over the network — OpenAI, Anthropic, Google, Mistral, local Ollama, and the newer gateways/routers (OpenRouter, Azure OpenAI, Bedrock). Connecting an agent is one line (an environment variable); discovery finds the rest automatically.

Two ways, and you pick based on where your agents actually run. As a native app on macOS, Windows, and Linux — desktop, laptop, or server. No Docker required, nothing to configure in a cloud. An enterprise fleet enrolls with a single join code; every host keeps its own identity and you keep central control of policy and versions. Or in your own cloud, if your agents already live there: one terraform apply stands up the whole platform on Kubernetes inside your AWS account — cluster, database, and an audit bucket with Object Lock — and your agents route to it in-VPC. Terraform for Azure and GCP follows the same shape; the AWS path is the one exercised end to end, and we'd rather point you at that than at a guide nobody has followed. Either way the privacy claim is identical and for the same reason: both run entirely on infrastructure you control. There is no AariaSec-operated service in the data path in either mode — "in your own cloud" means your account, your cluster, your credentials, not ours. Full cloud deployment guide →

AariaSec is built by security engineers around a patent-pending behavioral engine (223 claim families filed across two USPTO provisionals — March 25, 2026 and August 11, 2026). Every build is verifiable — each download ships a .sha256 sidecar you can check before you run it.