Catch the moment
an AI agent turns.

No. Every prompt and response is SHA-256 hashed at the moment of capture — the raw text is never written to disk, logs, or any database. AariaSec keeps behavioral fingerprints and metadata only, which is why it can run on sensitive workloads.

Behavior: which tools an agent calls, where it sends data, its timing and token rhythm, and how that compares to its own learned baseline. A tricked agent that still has your access looks wrong behaviorally long before any keyword filter would notice — that's the gap AariaSec closes.

Nowhere. Detection runs entirely on your device or server. Nothing is sent out unless you explicitly opt into anonymous, hash-only collective defense — and even then, only fingerprints leave, never content.

It runs entirely on your machine and binds to localhost only — nothing of yours is sent to AariaSec. Your agents' requests still go to their normal destinations; AariaSec sits in the middle just long enough to compute a SHA-256 fingerprint, then drops the raw content. The TLS certificate authority is generated on your device and its private key never leaves the machine. Nothing is written to disk or sent out.

Only if you turn that on. AariaSec ships in observe / alert-only mode — it watches and scores, and takes no action on its own. Automatic containment is opt-in and per-agent, and any block is reversible — you release an agent whenever you choose. Run it as a pure detection layer for as long as you like, or let it contain a confirmed-bad agent once you trust its verdicts.

Because we published the test. PRAMANA is an open benchmark that scores monitoring systems — not agents — on a corpus of behavioural traces containing no prompt text. Our results are on it next to the baselines, and we do not win every column: a forty-line longitudinal detector beats us on season v2, and we score zero on sybil coordination where it scores one. See the research section.

Any agent that reaches an LLM over the network — OpenAI, Anthropic, Google, Mistral, local Ollama, and the newer gateways/routers (OpenRouter, Azure OpenAI, Bedrock). Connecting an agent is one line (an environment variable); discovery finds the rest automatically.

No — AariaSec works alongside it. If you already run a content filter or AI firewall (Lakera, Meta Prompt Guard, a WAF), keep it: AariaSec ingests its verdict and correlates it with agent behavior, so a content flag plus behavioral drift becomes a high-confidence catch, while a content flag on otherwise-normal behavior is a likely false positive to tune. Only the verdict is read — never your content, and nothing is sent out to score. AariaSec is the behavioral layer beneath your filter, not a rip-and-replace.

Containment and monitoring answer different questions. A sandbox limits what an agent can do; it doesn't tell you what it did, or whether that was the thing you asked for. The failure we're built for isn't an agent escaping its container — it's an agent using the access you deliberately gave it, because someone planted instructions in a document it read. A coding agent with repo access that gets prompt-injected doesn't need to escape anything; it already has the keys. Sandboxing assumes the code is the threat, which is the right model for untrusted code. Agents invert it: the code is fine, the instructions are hostile. You want both — but if the sandbox is your only control, you find out what your agent did when someone else tells you.

A policy engine decides in microseconds, which means it decides from a table someone wrote in advance. That is genuinely useful, and it is why a firewall is fast — but it can only stop what you already knew to describe. AariaSec works the other way round: there is nothing to declare, because each agent's own history is the specification. We score how far today's behavior sits from that agent's established baseline, using the single-subject method from Applied Behavior Analysis rather than a population average. That catches what nobody thought to write down, and it is why we take seconds to adjudicate an ambiguous case instead of microseconds to match a rule.

A native app on macOS, Windows, and Linux — desktop, laptop, or server. No Docker required, no cloud dependency. An enterprise fleet enrolls with a single join code; every host keeps its own identity and you keep central control of policy and versions.

AariaSec is built by security engineers around a patent-pending behavioral engine (USPTO provisional filed March 25, 2026). Every build is verifiable — each download ships a .sha256 sidecar you can check before you run it.