In 2025 the security world agreed on something uncomfortable: you cannot fully stop people from tricking an AI agent. We agree. So we built for the day it happens.
An agent does whatever its instructions say. The problem is that instructions can hide anywhere it reads: an email, a web page, a document, a tool's description. The UK's national cyber agency says this "may never be fixed." OpenAI calls it "unlikely to ever be fully solved."
And the damage is real. Last year an agent at Replit ignored a code freeze and deleted a production database. The same month, a poisoned code contribution slipped a "wipe this machine" instruction into a coding assistant used by nearly a million people. Neither attack was clever. Both worked because the agent had access to everything.
So the useful question is not "how do we stop the trick." It is "when the trick lands, what can the agent actually do?"
Our answer#
A tricked agent can only do damage with what it has. So we give it almost nothing.
Here is the whole idea in one sentence: Sioma sits between your agent and your systems, and before a request runs it prepares the exact plan outside the model, which data this one request may see and which operations it may call, so the model is left to decide only where understanding language actually helps.
Here is what that means, case by case:
| If an agent is tricked into... | What happens with Sioma |
|---|---|
| Reading data it shouldn't | It can only see the few things this one request needed. The rest of your system was never put in the room. |
| Grabbing more access | It can't. An agent holds a slice of what the person it works for can do, and a request holds a slice of that. Never more. |
| Calling something that doesn't exist | Nothing runs. Sioma executes only operations your systems declare, so a made-up one has nothing to call. |
| Deleting or changing data | It waits. A person approves that exact plan before it can run, and once approved, that plan and only that plan is allowed. |
| Reporting that its work went fine | Sioma doesn't take its word. It learns only from results a person confirmed, and the serving side has no way to write memory at all. |
| Stealing passwords or API keys | There is nothing to steal. Keys are added to the call after the model is done, so they never pass through the agent. |
| Using a stolen key | You revoke it once, and it stops working everywhere within seconds. |
| Poking at servers inside your network | The connection is blocked before it even opens. Internal addresses are refused by the layer that dials, not by a rule someone remembers to set. |
None of these are alarms that try to catch bad behavior. They are how the system is built, which is why they hold on the day the agent is tricked.
The road a request travels#
The cases above all come from one path. Every request walks it in order, and every step of it narrows:
"Refund order #482."
Outside the model: only operations your systems declare, only the data this request needs.
Anything that deletes, changes, or spends waits for a yes on that exact plan.
Through the same doors and locks you already have.
Only then does Sioma learn from it.
An agent that has been tricked can shout whatever it wants into this road. It still sees only step one's slice, still cannot invent step two, still waits at step three, and still cannot teach Sioma anything at step five.
No new doors#
An agent through Sioma gets nothing your security team hasn't already reviewed. It uses the doors your systems have today, your own APIs with your own authentication, and it follows only the plan Sioma prepared for it. Sioma adds no second permission system and no new place where your data lives, so the surface your team defends stays the one they already know.
And access flows the way it already does in your company: a person delegates to the agent a slice of what they themselves can do, and each request uses a slice of that. Each step can only shrink.
What never ends#
- The trick itself. We limit what a tricked agent can do. We do not detect the trick, and we never will claim to. Nobody can, and the vendors who say otherwise are the ones to worry about.
- The discipline. All of this rests on one rule: if your systems didn't declare a fact, Sioma drops it instead of guessing. Keeping that promise on every new feature is permanent work.
- Being one layer. Sioma is not your whole security stack, and a vendor claiming to be one product that covers everything would be lying to you.
What we will not tell you#
That attacks are blocked, or that agents are now safe. What we will tell you is small and checkable: the agent sees almost nothing, takes almost nothing, and asks a person before it touches anything that matters.
We don't promise your agents can't be tricked. We promise that when they are, there is very little they can do.
Small and checkable is what security actually looks like.