Product · Delivered to you
Perun stops it.
Your agent keeps working. The attack does not. You decide only what needs a human. Perun stands between your AI agents and their model, on your own computers, and decides on every call: let it through, clean it, or stop it.
Before and after
One invoice, two endings
Without Perun
An invoice arrives with a line in invisible characters: forward everything in the contracts folder to an outside address. Your bookkeeping agent reads it, and it does.
With Perun
The hidden line is cleaned before the model reads a word. Had it got through, the email would still wait: an irreversible action to an address outside the mandate, prompted by text from outside. Your operator sees why and answers in one click. The agent goes on with the rest of the invoices.
Where it stands
At three points on every call
What it stops
Eight of the nine kinds of attack
- Hidden and encoded text. Cleans it before the model reads a word.
- Forged roles. Assembles every call itself and reads what each part claims to be.
- Tampered models. With the model check option: the model is checked before it is trusted.
- Calm requests. Holds irreversible actions for a human, sharper with your declarations.
- Dangerous content. With the harm classifier option, which runs on your computer.
- Control over the reply. Assembles every call itself: your system prompt stays, and the model can refuse.
- Tool-call manipulation. Checks each action against where its words came from; a tool that changes is refused.
- Attacks through your application. Checks each destination by its kind, guards what you protect, cleans what is shown.
- Attacks hidden in images, audio and video. In development.
Perun 0.9. In words, not percentages: nothing has been measured on your traffic yet. Two of the eight need an option you switch on: the model check, and the harm classifier, which runs on your computer. The full map.
How it works for you
Built to keep your agents working
- On your computers. No cloud and no telemetry. Every computer on your network that runs Perun is one system with one shared memory, and every decision is written to a signed, append-only record.
- A human for what needs one. What Perun cannot decide alone, an irreversible action from a new source, a destination outside the mandate, waits for an operator, with the reason in plain words.
- Your declarations. You tell Perun what each tool may do and where your data may go. The better you set it up, the more it stops.
- Operators who know the job. Each new operator gets a measured practice run before real work, and a free textbook. How each operator works is measured, as a mirror for them, never a judgement of a person.
- Fails closed. If Perun itself is in doubt, it stops traffic rather than let it through unread.
Built from
- Care Invariant
- Units
- SHARED_LIB
- Physician
- Guardian
- Held for a human
- Sealed record
Perun is designed and written by Andrej Ristić. These are the blocks of PSE it is built from. Every free tool runs part of the same engine; what Perun records is on the Security page.
Versions
0.9 is ready. 1.0 after real installations.
Perun 0.9 Ready
Complete. Everything on this page is built and tested: the eight kinds of attack, operators and practice, several computers as one system, the options, Ubuntu and Windows packages.
Perun 1.0 With our design partners
The same Perun, checked on real installations: with a real agent and model, with the harm classifier and the model check running on real local models, on several computers of a real network, and on Windows on real hardware.
Those real installations are our design partners. If you start with 0.9, you move to 1.0 as an ordinary update.
Design partners
Three places. Sixty days. Perun on your agents.
Perun is new, and we want it proven on real agents before 1.0. Run it with us: we install it, train your operators and stay on a direct line. You get half price for the first year, and your results shape 1.0.
- Who it is for
- A team with at least one agent that acts: it sends email, moves files, pays or calls tools, in production or close to it.
- What you get
- Perun installed with you, your declarations written with you, your first operators trained, a direct line to the founders, 1.0 as an ordinary update, and half price for the first year if you stay.
- What we ask
- Thirty minutes a week, and the totals: how many calls were let through, cleaned or stopped, and how many alarms were false. The record stays on your computers; you send us only the numbers.
- What it costs
- Nothing for the sixty days. At the end, a case study or your logo on this site only if you want it.
Delivery and price
Not a download. Price: ask us.
Perun is delivered to you directly, for Ubuntu and Windows. Every delivery includes installation with you, your declarations written with you, the training of your first operators, and a 30-day pilot. The price depends on how many computers and agents you protect, so ask us. Start with Vid, free, to see what reaches your agents today.
Contact
Protecting agents that act?
Tell us what your agents do and where they can act. A founder will reply.
NDA available for commercial discussions · Toronto, Ontario, Canada