Simulacrum
Behavioral guardrail layer for tool-calling AI agents.
Intercepts and analyzes every tool call an AI agent makes, watching the full action sequence rather than isolated prompts.
Overview
Most prompt-injection defenses only scan input text, so they miss attacks where the malicious instruction arrives disguised as a tool result. Simulacrum protects tool-calling AI agents by analyzing the full trajectory of an agent's actions over time, not just individual messages. It is also candid about its own limits: we tested whether combining detectors with simple rules beat the best single detector, found that it did not, and published that negative result rather than hiding it.
Key figures
331
automated tests passing
21
documented empirical findings published
6
real-time behavioral detectors
How it works
Intercept every tool call
Each tool call the agent makes is intercepted and analyzed in real time, in the context of the agent's full trajectory.
Check structure and intent
Schema conformance validates each call, and a semantic-divergence detector checks whether the action's parameters actually serve the agent's stated goal.
Watch for escalation and evasion
A permission-escalation detector flags when the agent's tool footprint expands beyond its task, and a tool-loop rate detector separates legitimate retries from evasion attempts.
Guard the data
Exfiltration monitoring watches for data leaving through tool calls, and LLM-based content-pattern analysis inspects what those calls contain.
Fail safely
A circuit breaker wraps every detector with configurable fail-open or fail-closed behavior, so high-risk operations fail safely closed if the guardrail itself degrades.
Key features
Six real-time behavioral detectors
Full trajectory monitoring
Risk-tiered response (allow/flag/approve/block)
Circuit-breaker architecture
Framework-agnostic integration
Interested in Simulacrum?
Tell us about your needs and we will get back to you within one business day.
Request a Demo