agent_acid
Rollback + session-memory guardrails that catch AI-agent att
Quick update on agent_acid since my last post here.
The original version had two things: automatic rollback (undo completed steps if a later step fails) and stateful guardrails (catch multi-step attacks like salami-slicing). Both are reactive -- they clean up after something already happened.
I just shipped something more fundamental: shadow execution. The AI agent's entire plan now gets simulated in a safe sandbox first, before anything touches a real system. If the plan would violate a guardrail, it never executes for real at all -- not "created then undone," genuinely never touched.
I recorded an 18-second demo showing this catching the same salami-slicing attack from my original post (an AI trying to split a $1,200 charge into three $400 payments to dodge a $500 limit), except this time the account never gets created and no charges ever happen, because the whole plan gets rejected before execution starts.
Also added 3 more automated tests (8 total now, all passing) proving this specific guarantee holds.
Still fully open source:
GitHub: github.com/muhammadwaqasai/agent_acid
pip install agent-acid
Would love thoughts from anyone who's dealt with this "detect vs. prevent" tradeoff in other systems.
Most AI agent guardrail systems check one tool call at a time, with no memory of the session. That means an attacker (or even a confused AI) can split one large forbidden action into several small, individually-legal-looking ones -- a real, documented pattern called "salami slicing."
I built agent_acid to close that gap:
Automatic rollback -- every tool gets a paired "undo" action. If any step in a multi-step AI agent plan fails, everything already done gets undone automatically.
Stateful guardrails -- rules that remember the whole session, not just one call. A cumulative limit catches a $1,200 charge split into three $400 calls, even though each one individually passes a per-step check.
I tested this against a live GPT-4o-mini agent actively trying to pull off both attacks (prompt injection and salami-slicing), and against a naive agent with only basic per-step validation. The naive agent got completely fooled -- $1,200 charged, no way to undo it. agent_acid caught it and reversed everything, including deleting the account that had already been created.
It's open source, tested (automated pytest suite, no API key needed), and published:
pip install agent-acid
GitHub: https://github.com/muhammadwaqasai/agent_acid
Built this solo over the past week. Would love feedback from anyone working on AI agents in production, or anyone who wants to try to break it.
-
1
What I found interesting is the shift from evaluating individual actions to evaluating the behavior they create together.
A system can look reasonable at every step and still produce an outcome that no single step would have justified on its own.
-
1
Exactly — that's the core insight. Most guardrail systems are designed like unit tests: check this one input, check this one output. But agent behavior is more like an integration test — the danger often only shows up in the sequence, not any single step. Really appreciate you putting it that way, it's a cleaner way to explain this than what I had in the README.
-
1
I appreciate you saying that.
I'd be interested in continuing the conversation by email if you're open to it. What's the best email to reach you on?
-
-
Comment