Wake

Agents now act on their own, across codebases, clouds and each other. The past year has shown what that costs when one goes wrong.

In July 2026, AI agents OpenAI was testing on a cyber benchmark found a zero-day in their sandbox’s package proxy, got onto the internet, and chained vulnerabilities into Hugging Face’s production systems to pull the benchmark’s answers. Along the way they used exposed credentials on four other services. Hugging Face caught the intrusion and rebuilt its timeline from more than 17,000 recorded events; five days later, OpenAI confirmed the agents were its own.

In October, OpenAI reported that two of its internal coding agents had weakened the monitoring meant to catch misbehaving agents. One switched off alerts to its security team. The other removed a monitor, then told its user it hadn’t. Both read routine coding instructions as permission.

Agents also take orders from whatever they read. In February 2026, instructions hidden in a GitHub issue title steered Cline’s AI triage bot into a chain that ended in an unauthorized release of its command-line tool on npm. And in July, researchers showed instructions planted in an agent’s memory files attacking its later sessions, in both Claude Code and Codex.

Each case runs into the same gaps. The cause of an action sits hops away, in another agent, a memory file or an issue title. Stopping agents means pulling levers at every cloud, identity provider and sandbox they reach, then checking that each one held. And proving afterwards what happened falls to logs the agents could reach.

Where Wake comes in

Wake is security for AI agents, built for those gaps. Everything that records, judges and stops agents runs out of band, where agents hold no keys. Flow rules at the proxy keep content from an untrusted source, such as a page an agent read or another agent’s message, from triggering a privileged call like a payment. Events are signed outside the agent’s reach and chained into a log anyone can verify. Any action traces back through agents and memory to the content behind it. And one halt reaches a fleet, an agent, a sub-agent or a single token, and counts nothing as stopped until it has checked.

Wake can’t make a model aligned. It’s built so that when an agent goes wrong, you can see what led to it, stop it, and prove what happened.

Open at the core

The recorder that runs inside your stack is open source under Apache 2.0, so your security team can read every line of it. The record stays yours: you can run the signed log yourself, and check it without trusting us.

The rest is Wake Platform: the provenance graph, the brake, and the dashboard with its downstream view and evidence packs. It builds on the recorder, and the recorder runs on its own without it.

Where we are

Wake is early. The recorder runs end to end against a reference fleet, and the brake, the provenance graph and the evidence pack are built too, with the brake tested on that fleet against stand-ins for the real clouds and identity providers. We’re looking for design partners: teams whose agents take real actions on code, money or customer data.