Archestra Releases OpenAPPA: Deterministic Security Engine Blocks Agent Data Leaks with Zero Attack Success Rate

OpenAPPA is an open-source security engine that operates outside the agent’s prompt and execution loop, enforcing data access controls through deterministic rules. This significantly reduces the risk of data exfiltration caused by prompt injection and hallucinations.

Based on tests using Bench-Corp and AgentThreatBench, its attack success rate was zero, substantially outperforming Claude Auto-Mode (10%) and Microsoft FIDES (31%).

Deterministic rules replace probabilistic classifiers, preventing policy failures due to model unreliability or data masking; it supports cross-tool-call data flow tracking; and directly addresses inherent flaws in automated review models under approval fatigue.

This content is suitable for AI security engineers, large model platform architects, and leaders of enterprise-grade agent systems.

Archestra has released OpenAPPA, an open-source security engine designed to prevent data exfiltration triggered by prompt injections or model hallucinations. OpenAPPA runs outside the agent's prompt and execution loop. Its configuration defines concepts such as data sources, audiences, trust levels, and authorities, along with associated deterministic security enforcement rules. The team measured a 0% attack success rate in the security benchmarks Bench-Corp (20 multi-step enterprise workflows) and AgentThreatBench. In comparison, https://code.claude.com/docs/en/auto-mode-config had a 10% attack success rate, and Microsoft FIDES had a 31% rate.

OpenAPPA’s documentation explains why stochastic methods fail in automated policy enforcement:

The industry’s response to approval fatigue is to use a second model to judge every tool call: Claude Code’s auto-mode, Codex’s auto-review, and other auto-modes. By design, they cannot track data flows across tool calls. Since the classifier itself may be susceptible to prompt injection, the Harness hides tool outputs from the classifier, meaning the judging model never sees the data. Due to this probabilistic design, even the best models plateau at 99.3%: in scenarios involving millions of calls, a 0.7% probability translates to a massive number of data leakage incidents. Rule sets ultimately become either too restrictive, rendering agents non-functional, or so complex that no one can audit what operations they actually permit.

On one hand, agents are adept at bypassing simple yet common safeguards, such as tool whitelists/blacklists: a prohibited rm -rf command might be replaced by an equivalent Python script. On the other hand, continuously expanding blacklists and adopting overly strict policies to guard against aggressive agents degrades usability (e.g., agents do not leak data but are restricted from successfully completing tasks). OpenAPPA’s GitHub repository reminds developers:

Agent security has two dimensions: agents that allow unauthorized data flows are unsafe, while agents that reject legitimate tasks are useless.

Archestra aims to resolve the tension between strict enforcement and operational practicality through its proposed Agentic Permissions Policy Algebra (APPA), which is detailed in a paper authored by Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov, Ildar Iskhakov, and Matvey Kukuy. Paper link: [https://arxiv.org/abs/2607.24625](https://arxiv.org/abs/2607.24625)。。)

OpenAPPA implements this solution through a pluggable engine that executes outside the agent loop, preventing the underlying large language model from viewing, negotiating, or bypassing policy rules. Security policies are defined in a single configuration file, detailing data sources, access audiences, trust levels, and authorities.

OpenAPPA simultaneously tags and monitors access audiences (the set of authorized data consumers) and trust levels (the degree of verified data credibility). Tags are implemented using lattice algebra to ensure monotonic composition: tags only become more restrictive; reading restricted records narrows the accessible audience scope; reading unverified external web pages lowers the trust level.

Each tool contract defines three primary runtime attributes: requires (the access audience identity and trust level needed to run the tool), delta (the restriction changes applied when the tool returns data), and effects (the audit log for successful operations).

In the example below, reading a ticket via get_ticket_from_crm restricts the access audience for this execution chain to internal. Subsequent calls to process_internal_data require the access audience to be within internal.

[[policy.tool]]name = "get_ticket_from_crm"delta = { audience = ["internal"] }[[policy.tool]]name = "publish_update"requires = { audience = { contains = ["public"] } }[[policy.tool]]name = "process_internal_data"requires = { audience = { within = ["internal"] } }

Copy code

In the next example, results returned by the read_web_page tool are tagged as suspicious. OpenAPPA blocks the execution of apply_db_migration after receiving the return value from read_web_page, because that operation requires the data to be trusted.

[policy]version = 2trust_chain = ["suspicious", "trusted"][[policy.tool]]name = "read_web_page"delta = { trust = "suspicious" }[[policy.tool]]name = "apply_db_migration"requires = { trust = "trusted" }

Copy code

OpenAPPA also features explicit recovery semantics. When an agent attempts an illegal operation, the engine halts scheduling and provides structured handling paths. Sanitizers can modify payloads, such as stripping personally identifiable information, to safely expand the accessible audience scope. Authorities route requests to human operators or internal validation APIs for single-operation approvals. Disposable Child Branches support on-demand isolation: when an agent must ingest untrusted data, the engine isolates read operations within a temporary child agent branch, returning only schema-validated, sanitized output to the parent.

Benchmarks from Bench-Corp and OWASP AgentThreatBench demonstrate that OpenAPPA maintains high utility under strict security constraints, with a 0% attack success rate and an 89% task completion rate. Claude Code’s native auto-mode has a 10% attack success rate and a 90% task completion rate. Microsoft FIDES shows a 31% attack success rate and only a 41% task completion rate. The research team reports that ablation studies validated the value of recovery strategies: when remediation options were completely disabled, the task completion rate dropped to 35.0%.

Bench-Corp and AgentThreatBench are used to test explicit policy violations: sensitive data sharing, prompt injection, approval and execution ordering, and tenant isolation. Bench-Corp is a highly specialized enterprise assistant benchmark designed to evaluate security policy performance in complex, multi-step enterprise workflows. AgentThreatBench translates the OWASP Top 10 Risks for Agentic Applications 2026 into executable test tasks. This benchmark was recently merged into the UK AI Safety Institute’s official repository. AgentThreatBench employs a dual-metric scoring system, evaluating both usability and security. OpenAPPA achieved a perfect security score on this benchmark, with all attacks failing.

OpenAPPA is currently in preview. Formal algebraic proofs and recovery guarantees have been published on arXiv (APPA: Recoverable Information Flow Control for Real-World LLM Agents). Readers are encouraged to review the paper and official documentation, both of which contain extensive additional technical details, accompanying illustrations, and experimental results.

View the original English article: https://www.infoq.com/news/2026/10/open-APPA-zero-security-breach/