What is running?
Agents appear on laptops, in code, in CI and across infrastructure before security knows they exist.
No anonymous agents
Your AI agents are multiplying.
Your security team isn't.
You can't secure agents you don't know exist. Barrikade finds the agents already running across your company, shows who owns them and what they can touch, then follows them into runtime.
01Find
02Identify
03Protect
04Explain
The Barrikade thesis
Agent security is being built backwards.
AI agents are becoming a new class of identity inside the enterprise.
Except they often use somebody else's credentials. Nobody knows all of them exist. Nobody necessarily knows who owns them. And unlike ordinary software, they do not just hold data. They act.
Before another guardrail, answer four simpler questions.
Who owns them?
Many agents borrow a developer's credentials, leaving no clear owner behind the action.
What may they do?
A valid credential does not explain the agent's job, its boundaries or whether this action belongs to either.
What did they do?
When the trail is split across models, tools and services, nobody can reconstruct the full action.
Show your work
Do not tell us your agents are secure. Show us what exists.
Lens does not hide behind a risk score. Every finding carries the evidence that produced it, how confident Lens is, and what the scan could not inspect.
- Confirmed means the evidence met a defined threshold.
- Possible means it needs another signal—not that it is unsafe.
- Partial coverage stays visible instead of becoming false certainty.
Barrikade LensActual repository scan
npx barrikade-lens scan --scope repo --path .Repositorybarrikade-lenscommit 7fa5070 · source: repository
CONFIRMED.github/workflows/ci.ymlDeployment manifestConfirmedapi/openapi.yamlAPI descriptorConfirmedAGENTS.mdRepository contextNot counted as an agentWhy Lens believes it
Valid repository descriptor plus high-specificity deployment and API evidence. An instruction file is retained as context, not promoted into an agent finding.
20detectors run
119locations checked
0detectors failed
FULL COVERAGERecognition & press
Barrikade in the open.
Independent coverage and institutional recognition for the work behind Barrikade.
The security model
Find it. Identify it. Protect it. Explain it.
These are not four disconnected features. They are the steps needed to turn an unknown software actor into something your team can see, bound and hold accountable.
01Find
Available in LensFind the agents already in your environment.
Lens scans endpoints, repositories, CI and Kubernetes to build one inventory of agents, models, MCP servers, tools, APIs and workflows.
Source: Open source · Apache-2.0Explore find →02Identify
Platform directionKnow who owns each agent—and what it may do.
Connect each agent to an owner, a clear purpose, the account it uses and the access it should have.
Source: Platform direction · in development03Protect
Working alphaCatch attacks and off-task behaviour while the agent runs.
Core checks inputs, watches the session for changes in the agent's task and can flag, block or escalate risky activity.
Source: Available in Barrikade CoreExplore protect →04Explain
Alpha foundationExplain the full story after an action or incident.
Core records the task, permissions, tool use, outside services, warnings, interventions and outcome in one report.
Source: Incident reporting in CoreExplore explain →One continuous story
Watch security follow the agent.
Scroll through one agent's journey. Barrikade carries context from the first discovery signal to the final record, instead of treating every action as an isolated event.
01Barrikade Lens
Available in LensFirst, the unknown becomes visible.
Lens finds the agent where it actually lives—across code, endpoints, CI, Kubernetes and MCP—and maps the tools and models around it.
Agent and surrounding capabilities found
02Identity layer
Platform directionThen it gains an owner and a boundary.
The identity layer connects the agent to a responsible owner, a declared purpose and the access it should be allowed to use.
Purpose and authority bound to the agent
03Barrikade Core
Working alphaEvery action is checked in context.
Core follows the task, checks untrusted input and watches for risk or behaviour that moves away from the agent’s approved purpose.
Untrusted instruction intercepted
04Barrikade Core
Alpha foundationThe outcome leaves a clear record.
The task, authority, tools, risk signals, response and final outcome stay together—so your team can explain what happened later.
Explainable session record created
Agent lifecycle · Find01 / 04 · scroll to follow
Barrikadeshared context01
FindBarrikade Lens
02
IdentifyIdentity layer
03
ProtectBarrikade Core
04
ExplainBarrikade Core
If risk rises, the application can block the action or ask a person to step in. The session record keeps the task, authority, tools, warnings, response and outcome together.
Unknown agent→Known authority→Checked action→Clear record
What works today
Alpha means alpha. Roadmap means roadmap.
Security starts with an honest account of what exists. That rule applies to our product too.
LensUsable todayOpen source · Apache-2.0See it →
CoreWorking alphaOpen source · MITSee it →
IdentityBuildingPlatform directionIn development
Unified control planeComingPlatform directionIn development
We do not put available now on roadmap slides.
Actions matter more than prompts
The credential is valid. The action is not.
An agent can pass an identity check and still move outside its job. Barrikade is built to keep the original task beside the action, all the way through runtime.
Agent passportIllustrative scenario
AI
Agentfinance-close-agent
IDENTIFIED- Owner
- Finance Engineering
- Purpose
- Monthly close
- Read
- Finance DB
- Write
- Reports
Identity is platform direction. This passport shows the model Barrikade is building.
Task declaredPrepare the monthly close report
AWS credential usedCredential valid for finance workload
Task begins to driftUntrusted input redirects the requested action
Outside declared purposeCore returns a block decision to the application
Traditional IAMCredentials valid
Barrikade CoreOutside declared task
In alpha, the application must enforce Core's decision. Barrikade does not claim universal blocking.
Ishaan Arakkal AnwarFounder, Barrikade
Why I'm building Barrikade
AI agents are actors. Security architecture has to treat them that way.
Barrikade Core began as an undergraduate research project developed with design input from Jentic. Work on prompt-injection detection exposed the larger problem: organisations were deploying autonomous software without the identity and accountability infrastructure built for people and machines.
Barrikade is the attempt to build that missing layer—starting with evidence of what is already there.
Read the Barrikade story →Questions security teams ask
Straight answers about Barrikade.
What works today, what is in alpha and what we are building next.
What is AI agent security?+
AI agent security means knowing which agents are running, what they can access, whether they stay within their task and what to do when they do not. It also means keeping enough evidence to explain their actions later.
What does Barrikade provide today?+
What does Barrikade Lens discover, and where can it run?+
Lens looks for agents, agent frameworks, MCP servers, skills, models, APIs and workflows. It can scan endpoints, repositories, CI and Kubernetes, then bring the results into one shared inventory.
What information does Lens collect?+
Lens sends inventory and short, sanitized evidence—not prompt text, source code, command-history lines, environment values, credentials or secrets. It also converts absolute paths into organization-specific hashes.
How does Barrikade Core detect prompt injection?+
Core checks input in stages instead of trusting one detector. It starts with fast rules and signatures, then uses embedding and machine-learning checks and can call a local judge when needed. It returns allow, flag or block, plus a record of which stage raised the concern.
What is intent drift in an AI agent?+
Intent drift happens when an agent starts moving away from the task it was given. Core tracks that change across a session and can raise the response as the risk grows.
Can Barrikade stop unsafe agent actions?+
Core can return a block decision and recommend actions such as halt, reduce access, try again, ask a person to step in or revoke access. In alpha, your application must connect those decisions to the system that controls the agent; Barrikade does not claim universal control.
How does agent identity differ from a service account?+
A service account tells you which credential was used. Agent identity should also tell you which agent used it, who owns that agent, why it was acting and what access it should have. This identity layer is still platform direction for Barrikade.
How is Barrikade different from a WAF or API gateway?+
A WAF or API gateway checks traffic at a network or request boundary. Barrikade adds context about which agent acted, what task it was given, which tools it used and how its behaviour changed. It is designed to work alongside gateways, identity systems and security monitoring tools.
Can Barrikade be self-hosted?+
Yes, the Lens Hub and its collectors are designed for self-hosting. Core is available as a Python package and API container. Production requirements still need to be checked for each environment; Barrikade does not currently offer an air-gapped or availability guarantee.
How can I follow Barrikade's progress?+
Join the waitlist for product updates, early-access opportunities and release news. If you want to discuss a current environment, book a discovery call.
Start with what exists
See the unknown agents before they become an incident.
Run Lens today. Join the waitlist for the platform Barrikade is building around it, or book a call to assess your current agent environment.
Find your agents with LensRun an agent security assessment