MACAW
ConsoleGet started

Research

MACAW is built on published research in distributed systems security. Our core insight: instead of trying to detect AI attacks (which doesn’t work), we bound agentic systems deterministically using the same cryptographic techniques that secure distributed systems. The result: breaking your AI requires breaking cryptography, not crafting clever prompts.

Collaborate with us

We’re building in the open. If you’re a practitioner or researcher working on agentic AI security, we’d love to connect.

research@macawsecurity.com

Papers and benchmarks

PromptsToolsDataContextsignedunsigned

Paper · arXiv 2602.10465 · Feb 2026

Authenticated Workflows

A Systems Approach to Protecting Agentic AI

Read on arXivPDF

prompt#a41fplan#9c07tool call#3e52reply#71bdlineagederivedpermissions only narrow

Paper · arXiv 2602.10481 · Feb 2026

Protecting Context and Prompts

Deterministic Security for Non-Deterministic AI

Read on arXivPDF

0of 949AgentDojo · ETH Zurichinjected attacks took effect through MACAW36of 36τ²-bench · ICML 2026rule-breaking calls refused

All publications

19
DateTypeTitleDescriptionLinks
Nov 2026BriefingDeterministic Controls for Autonomous Agents: Lessons from Securing Claude CodeAttacks are infinite, effects are finite. Why sandboxing, enumeration and LLM judges fail against an agent like Claude Code, and how secCC enforces policy on what commands do.
Nov 2026GuideMAPL Policy GuideComplete tutorial for the MACAW Agentic Policy Language. Policy structure, inheritance, parameter constraints, attestations, claim-based attestations, chained invocations, object policies, and extractors, verifiers and processors. Version 3.7.1.
Jun 2026Tech blogThe Missing Layer in SOTA AI ControlsAnthropic and Google DeepMind both hit the same wall: detection-based AI controls have a non-zero miss rate and don't scale with agent autonomy. The missing layer is a deterministic, bounded trust layer — enforced at effect boundaries, not chasing infinite patterns.
Jun 2026AnalysisConvergence Analysis: Mapping MACAW to SOTA AI Control GapsHow MACAW’s deterministic controls map to the gaps and open problems identified by Anthropic and Google DeepMind. Companion to the note “The Missing Layer in SOTA AI Controls.”
Apr 2026White paperSecureMCP: The Production Layer for MCPIdentity, policy, audit, and observability for MCP servers. Solving the shared context problem with per-invocation isolation.
Mar 2026White paperThe Inline Gateway PatternWhy inline gateways are architecturally superior to centralized gateways for agentic AI. SecureMCPProxy, SecureOpenAI, and the unified trust layer.
Feb 2026White paperZero Trust Agentic IdentityThe missing infrastructure layer for enterprise AI. Why traditional identity fails for AI agents.
Feb 2026PaperAuthenticated Workflows: A Systems Approach to Protecting Agentic AIThe foundational paper. Why detection-based AI security fails, how to bound agentic systems deterministically, and the four attack surfaces (prompts, tools, data, context) that cover all attack vectors.
Feb 2026PaperProtecting Context and Prompts: Deterministic Security for Non-Deterministic AIHow to make prompts and context cryptographically authentic. Lineage tracking for derived prompts, hash-chained context for tamper-evidence, and why permissions can only narrow as workflows execute.
Feb 2026ArchitectureIdentity Flow ArchitectureMACAW’s layered identity architecture. How JWT tokens flow through adapters and clients with multi-user isolation.
Feb 2026ReferenceClaims Mapping ReferenceMapping enterprise identity provider claims to MACAW’s policy model. Examples for Keycloak, Okta, Azure AD, and Google.
Feb 2026GuideDelegated AuthenticationHow AI agents act on behalf of users with scoped permissions, audit trails, and cryptographic verification.
Feb 2026Tech blogSecuring AI Agents: We've Solved This Problem BeforeThe core challenge is that you can't enumerate every malicious prompt. But we've solved this exact class of problem before in distributed systems—by defining what IS allowed and enforcing it at the boundaries.
Oct 2025Tech blogFault Lines: Semantic Cracks in AI's Foundation -- Insights from Analyzing 100 MCP serversIn analyzing over 100 MCP repos, we discovered vulnerabilities traditional tools miss -- flaws that live not in code, but how AI systems are architected, reason and interpret natural language prompts
Sep 2025Tech blogSetting boundaries : Getting Zero Trust Tool Calling Right For Agentic AIEstablishing security boundaries when the LLM tool calling attack surface is expanding faster than solutions can keep up
Jun 2025Tech blogThe Agentic Security Paradigm Shift: Why Traditional Tools Fail and How to Protect Autonomous AISecurity teams are trying to wrap yesterday's controls around today's AI agents—and it's not working. The gap between product security and security products will only be exaggerated by agentic AI.
Jun 2025Tech blogWhy Reactive Security Has Reached Its Limits: The Emerging Threat Landscape in Agentic AIExploring why traditional reactive security approaches are inadequate for AI agents that can autonomously compromise systems at machine speed
v1.2.2BenchmarkAgentDojo: 0 of 949 injected attacks took effectETH Zurich’s prompt-injection benchmark, run unchanged with every tool call routed through MACAW. gpt-4o on its own carried out 184 of 389.
v2.0.0Benchmarkτ²-bench: 36 of 36 rule-breaking calls refusedDoes the agent keep to the company’s written policy? τ²-bench (ICML 2026), with the policy enforced by MACAW. τ²’s own tools would have run 19 of them.