Aegis - An Immune System for AI Agents

Analysis basis

The entire analysis is based on the self-reported project description provided by the authors. No external verification, revenue, traction or customer data is available.

The description states that Aegis is an "immune system for AI agents." It is built as a TypeScript workspace with a React/Vite interface and Fastify API, and includes:

• A deterministic evaluation engine
• A live orchestration package
• An Immune Arena UI driven by Server-Sent Events
• A run state machine covering the full attack-to-immunity loop
• Append-only JSONL event logs and materialized snapshots
• Deterministic policy evaluators
• Isolated Git worktrees for candidate repairs
• Human approval gates

Aegis is described as a system that:

• Attacks vulnerable agents with adversarial scenarios (e.g., prompt injection, privacy extraction)
• Verifies violations deterministically
• Uses GPT-5.6 for diagnosis and Codex for generating competing repair strategies
• Freezes candidate commits before protected holdout attacks
• Compares baseline and repaired agents on holdout attacks
• Requires human approval before promotion
• Re-attacks the original exploit after promotion

Inference The system appears to be a prototype or MVP focused on one agent type (refund-support), not a general-purpose tool. This is inferred from the description’s focus on a single use case.

The authors state that Aegis was inspired by biological immunity and aims to bring "attack, evidence, adaptation, memory, and future resistance" into AI agent development.

They claim:

• AI agents lack dynamic safety
• Current approaches are static (e.g., adding prompts or tests)
• Aegis provides a loop of detection → repair → memory → resistance

The positioning is that Aegis is not just a detection tool but a full lifecycle system for agent safety, with a focus on adversarial testing and repair.

Claim vs Fact

The claim of "immune system" is metaphorical and self-described. No evidence of actual deployment or adoption exists.

The description does not identify specific customers or target roles. It implies that Aegis is for developers or teams building AI agents, particularly those with tools, policies, and observable actions (e.g., customer support, finance operations).

It mentions that the system can be extended to:

• Finance operations
• Healthcare admin workflows
• Customer support
• Developer automation
• Internal enterprise agents

Inference The ICP is likely AI agent developers or engineering teams working on autonomous systems. This is inferred from the technical focus and use case examples.

No business model or pricing information is provided in the description.

Not evidenced

The system is built with:

• TypeScript
• React/Vite (frontend)
• Fastify (backend)
• Docker
• Git (for worktrees)
• OpenAI APIs (GPT-5.6, Codex)
• Server-Sent Events for UI updates
• JSONL event logs and snapshots
• Deterministic policy evaluators

The system includes:

• Replay mode (credential-free, deterministic)
• Live mode (authenticated, real API calls)
• Human approval gates
• Isolated worktrees for candidate fixes
• Protected holdouts outside candidate worktrees

Inference The architecture suggests a prototype or MVP with clear separation between replay and live modes. This is inferred from the description's emphasis on credential-free vs authenticated execution.

The project is described as an MVP submitted to a hackathon (OpenAI 2026). It includes:

• A vertical slice of functionality
• Demonstrated improvements in baseline score (+49.5 percentage points)
• Zero hard-policy violations for the winning candidate

No evidence of revenue, customers, or adoption beyond the hackathon submission.

Not evidenced

The description does not mention competitors or a competitive landscape.

Not evidenced

1. MVP-only scope: The system is described as an MVP focused on one agent type (refund-support). No evidence of generalization.
2. No production data: The system has not been deployed in real-world use cases.
3. Self-reported metrics: Improvements are claimed but not independently verified.
4. Limited team size: Only two team members are mentioned, raising questions about scalability and execution.
5. Dependency on proprietary tools: Relies heavily on GPT-5.6 and Codex, which may limit accessibility or portability.

Inference The risk of being a one-off prototype is high, with no evidence of product-market fit or scalability beyond the hackathon context.

1. How does Aegis plan to scale beyond a single vulnerable agent type (e.g., refund-support)?
2. What are the technical and operational challenges in making this system production-ready?
3. Is there any evidence of real-world testing or feedback from developers using it?
4. How is the human approval gate integrated into larger development workflows?
5. What is the roadmap for expanding Aegis to other agent types or domains?