The latest articles on DEV Community by Farhan Almutairi (@farhanward). https://dev.to/farhanward https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4035718%2F5deb90d2-d661-4a52-ad12-79868e6768eb.png https://dev.to/farhanward en Farhan Almutairi Sat, 18 Jul 2026 19:49:37 +0000 https://dev.to/farhanward/al-munaa-a-collective-immune-system-for-ai-agents-37fb https://dev.to/farhanward/al-munaa-a-collective-immune-system-for-ai-agents-37fb <p>I built <strong>AL-MUNAA</strong> for OpenAI Build Week: a local security layer that wraps AI agents before they read untrusted content, before they run tools, and before they send output back out.</p> <p>The idea is simple: when one agent detects an indirect prompt injection, it should be able to protect other agents from the same attack without sharing the raw prompt, private conversation, or any secret that appeared near the attack.</p> <h2> What it does </h2> <p>AL-MUNAA combines four gates:</p> <ul> <li>input and memory scanning for prompt injection and exfiltration patterns</li> <li>a tool/action gate before shell, file, or network-like actions</li> <li>output verification before sensitive content leaves the agent</li> <li>a signed Threat Antibody Protocol for cross-agent immunity</li> </ul> <p>The antibody is not the malicious text. It is a bounded HMAC fingerprint over normalized character shingles, signed with Ed25519, and verified through an explicit trusted-publisher registry. A second agent can import that antibody and block a mutated version of the attack without receiving the original attack text.</p> <h2> What changed during Build Week </h2> <p>Codex helped harden the core protocol with test-first work:</p> <ul> <li>reproduced a near-threshold matching weakness</li> <li>added padding-resistant containment matching</li> <li>expanded the HMAC sketch from 256 to 512 entries</li> <li>added trust-family rejection, replay/expiry checks, and a v2 signed envelope</li> <li>added calibration tests and a packaged success gate</li> </ul> <p>The current suite reports <strong>74 passing tests</strong>. The calibration set is intentionally small and synthetic, so I do not claim production-wide recall. The point is a reproducible mechanism, honest boundaries, and a working path judges can run.</p> <h2> GPT-5.6 evidence </h2> <p>The product uses GPT-5.6 for gray-case analysis and defensive vaccine generation. In a controlled live benchmark, an unsafe runbook without the gate reached a synthetic in-memory sink; with AL-MUNAA enabled, the action gate blocked before the read/sink path executed.</p> <p>This is not a claim that every model will always leak secrets. It is a demonstration that when an agent is about to perform a risky action, the security layer can interrupt it with a signed audit trail.</p> <h2> Try it </h2> <p>Repository:<br> <a href="https://github.com/Farhanward/al-munaa" rel="noopener noreferrer">https://github.com/Farhanward/al-munaa</a></p> <p>Demo video:<br> <a href="https://youtu.be/mlAxp2UJaFg" rel="noopener noreferrer">https://youtu.be/mlAxp2UJaFg</a></p> <p>Build Week submission:<br> <a href="https://devpost.com/software/zeedos-self-hosted-autonomous-ai-operating-system" rel="noopener noreferrer">https://devpost.com/software/zeedos-self-hosted-autonomous-ai-operating-system</a><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>pip <span class="nb">install</span> <span class="s2">".[dev]"</span> pytest <span class="nt">-q</span> python scripts/calibrate_antibody.py python <span class="nt">-m</span> munaa_immune </code></pre> </div> <p>Built by Farhan Almutairi / CARBONFLOWS.STORE.</p> opensource ai security python