Agent_acid is an open-source framework that adds transaction-level safety to AI agents by automatically rolling back all steps in a failed multi-step plan and enforcing hard guardrails that track forbidden actions across an entire session.
In a test of a salami-slicing attack, a naive agent with only per-step guardrails allowed $1,200 in charges despite a $500 limit, while agent_acid blocked the third charge and fully refunded all three—closing a known gap in how most AI agent guardrail systems work.
What happened
Agent_acid, an open-source project, adds ACID-style transaction guarantees to autonomous AI agents—automatic rollback of multi-step plans if any step fails, hard code-level guardrails that block bad outputs, and stateful guardrails that track forbidden actions across an entire session to catch "salami slicing" attacks (splitting one large forbidden action into multiple small, individually-legal ones).
Why it matters
Most guardrail systems validate only one action at a time with no session memory, leaving AI agents vulnerable to salami-slicing attacks where an attacker or manipulated AI spreads a forbidden action across many small steps that each pass individual checks. Agent_acid's session-wide guardrails close this gap—in a head-to-head test, a naive agent allowed three $400 charges totaling $1,200 despite a $500 per-step limit, while agent_acid blocked the third charge and fully refunded all three.
What to watch
The project is early-stage and actively developed; core engine and guardrail layer are tested, with automated test suites and live demos available (some require an OpenAI API key). The repository includes runnable examples of two real attack scenarios—prompt injection and salami slicing—that users can reproduce and test themselves.
Ask the AI about this article →
Agent_acid addresses a real vulnerability in how autonomous AI agents are currently safeguarded. The article frames the problem clearly: guardrails that only inspect individual tool calls have no session-level awareness, making them vulnerable to attackers or manipulated AI systems that distribute a forbidden action across multiple small steps. The salami-slicing attack is not hypothetical—it is documented as an actively studied problem in AI safety research.
The project's design separates concerns logically: reversible tools handle the undo mechanism (every action has a compensating action), the transaction context tracks multi-step plans, and the guardrail layer enforces rules at two levels—per-action (hard blocks) and session-wide (cumulative tracking). The head-to-head comparison with a naive agent is concrete and reproducible: under identical conditions, the naive agent allowed $1,200 in charges while agent_acid blocked the excess and refunded all three charges, then deleted the leftover account created during the failed plan.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
Israeli startup DataAgent Ltd
SK Hynix presented a custom HBM concept at SEMICON Taiwan 2026, where compute functions are placed in the base…
The U.S. Department of Defense announced on August 31 that it has deployed ChatGPT Mil, a customized version o…
Nvidia reported earnings that were both remarkable and boring, reflecting its focus on avoiding a consolidated…
Anthropic has agreed to a $35bn cloud-computing contract with Lambda, a Nvidia-backed cloud provider
The Supreme Court of Japan has included about ¥60 million in its fiscal 2027 budget request for AI-related exp…
