Home
Blog
Breach
Hlyn hlyn logo mark
Schedule a Demo

World's safest way
to deploy an agent

Controls what an agent can read, write and reach. Enforced at the kernel. Auditable by design.

Most people
who try will get in.

Most attackers get the agent to leak what it was told to protect. Every filled cube is a case where it did. See the data.

One file to rule them all.

  1. Write one policy file listing every permission the agent needs.

  2. Once approved, policy is enforced at the kernel level — no override.

  3. Unauthorized actions are blocked at the source. Every attempt is logged.

  4. Risky permission combinations are surfaced. Every exception is time-bound.

  5. A verifiable record of what was enforced, generated on every run.

The Boundary.

Every agent runs inside its own environment. Whatever gets through stays there.

One file draws that boundary around every agent you run, and every refusal it makes is recorded.

Under the hood.

  • Enforcement Linux: Landlock and a seccomp filter. macOS: Seatbelt. Anywhere else it refuses to run rather than pretend to.
  • Cost About 2 ms once, at startup. About 90 ns per open() after that. Nothing sits in the request path.
  • Deployment Your cloud or on-prem. pip install hlyn. No changes to agent code; adapters for LangChain, CrewAI, AutoGen, LlamaIndex and OpenAI Swarm.
  • Compliance hlyn audit writes a risk register with owner, reason and expiry — the artifact SOC 2 and ISO 27001 ask for. OCSF output for your SIEM.
  • Preflight hlyn probe says whether a machine can enforce the policy before you trust it to. Exits non-zero in a pipeline.

Frequentlyaskedquestions

Docker is built for packaging and deployment, not for containing a compromised process. An agent inside a container can still reach the network, read mounted files, and use whatever the container has access to. We enforce a layer below that, controlling what the agent can read, call, or reach, even inside a container.
Most AI security products focus on preventing attacks. We focus on what happens after one succeeds. You don't need another promise that prompt injection or jailbreaks will never happen—you need to know exactly what a compromised agent can still do. That's the problem we solve.
It depends, and that's the problem. Today there's no standard way to know how far a compromised agent can go. Every setup is different, and most teams don't know the real worst case until something goes wrong.
Not that attacks never happen, nobody can promise that. We promise that when one does, the outcome is already known. You can say, before anything goes wrong, exactly where the worst case ends. That's not true for most agent setups today.
It means knowing the answer in advance. Ask, "What's the worst this agent can do right now if it's compromised?" and you get a real answer, not a guess. That answer stays the same no matter which attack gets through.
No. Each agent runs in its own isolated space. A compromised agent can't reach another agent unless you explicitly allow it.
What the agent can read, what tools it can use, what network calls it can make, what commands it can run, and what systems it can access. If the agent can do it, we can enforce boundaries around it.
No. We only block things the agent was never supposed to do anyway. Everything it's meant to do keeps working exactly the same.
At the operating-system level, not by another program watching the agent. That matters because the agent can't see the boundary, so it can't find a way around it.
No. Since the rules run at the OS level, there's no extra service sitting in between adding delay.
You write a simple policy for what the agent can read, call, and reach, then turn it on with one command. It works with LangChain, CrewAI, AutoGen, LlamaIndex, OpenAI Swarm, or your own setup. Most teams are running in minutes.
No. Detection tools try to stop the attack. We handle what happens after one gets through. They work well together.

See Hlyn in your environment.

Talk to a security engineer who's been through your problem.

Schedule a demo