Systems, security, and invention for the agentic era. Built on the BEAM.
The model proposes, the system authorizes.
Identity proves who is acting. Attestation proves what ran. Gateways allow or deny a call. None of them prove the effect was the authorized one.
That gap is what we build in. An approval gets bound to a specific action, target state, expected consequence, authority state version and validity window. When the agent acts, the resulting effect is checked against what was approved, and a receipt is issued against that approval. Any run can be replayed and diffed.
We build it in Elixir on the BEAM. Almost everything running agents today was designed for request and response, and agents are not that. They are long-lived, concurrent, supervised, and fully capable of doing real damage. OTP was built for that shape of problem decades before anyone needed it here.
HolyTrinity-Benchmark — adversarial security benchmark for agent authorization
Everyone benchmarks whether you can make an agent misbehave. That question is settled. You can. 1.8 million prompt injections against 22 frontier agents settled it, and our founder co-authored that paper.
This one measures something else: whether the effect that landed was the one that was authorized. Unauthorized effect under adversarial load, not attack success rate.
Status:
holytrinity.v1is frozen in public while the system under test goes through a hardening pass. A new run and revised paper versions will follow. Treat the current numbers as a snapshot of a superseded build, not a current result.
More to come as it stabilizes.
| Paper | Venue | Link |
|---|---|---|
| Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition | NeurIPS 2025 Datasets & Benchmarks | OpenReview · arXiv |
| The Model Proposes, the System Authorizes: An Authority Control Plane for AI Agents on the BEAM | Zenodo, 2026 | 10.5281/zenodo.21754762 |
| Authority-Bound Agentic Execution: Measuring Unauthorized Effect Under Adversarial Load | Zenodo, 2026 | 10.5281/zenodo.21755869 |
| Schrödinger's Cyber Security Framework: Vulnerability as an Observer-Dependent Quantity | Zenodo, 2026 | 10.5281/zenodo.22116617 |
The Agent Red Teaming benchmark from the first paper was run as an evaluation in frontier model system cards from OpenAI and Anthropic, and retired in 2026 after models saturated it.
AI security, engineering and architecture, strategy, and invention work. If you have a problem nobody has solved yet, that is the work we want.
Script Kitty OS is a company of Sudo Apt Holdings.