When Their AI Agents Wreak Havoc, the Answer Isn't a Better Firewall

Causum releases the first open protocol that treats an AI agent's authority to act as a governed, expiring grant

LOS ANGELES, Aug. 20, 2026 /PRNewswire/ -- In the aftermath of unprecedented AI attacks, leaders from OpenAI and elsewhere have been dressing network security as AI security. Their message: "it's not the chaos agents being unleashed, it's your inability to protect yourselves from them". But a small team of scientists is pushing back.

"We're tiny, bootstrapped, yet mighty," says CEO of Causum (causum.com) Ray Fatahi. Today, they're announcing their AI Agency Protocol (AIAP), available on gitlab.com/causum/aiap. "This protocol is designed to put the 'agency' in agentic AI," says Dr. Fatahi. Agency is an old principle where a delegate assumes responsibilities by being allowed to step into the shoes of a delegator for making decisions on their behalf. It is bounded, purposeful, and it ends.

AIAP makes that structure enforceable in software. An agent's identity persists and its capabilities persist, but its authority to use them does not: authority is granted only when purpose, context, and policy justify it, and it expires when the purpose is met, the clock runs out, or an operator revokes it. Requests go to an agency broker, which either issues scoped, time-limited credentials or executes the action itself so the agent never holds a credential at all. When an agent delegates to another agent, the authority can only narrow. The protocol calls this Least Agency: no more authority, for no longer, across no wider a context, than the present purpose justifies.

"The loudest mouths in the room are dressing AI security as network security, most likely because it's all they understand." Dr. Fatahi argues that leading solutions in AI security are designed to protect systems against people, as has been the norm for the entirety of the field of cybersecurity. However, he contends that AI security is primarily about safeguarding human interests from the machines.

The example he points to is recent. On August 17, OpenAI president Greg Brockman published "The Defender's Window," his takeaways from the incident in which OpenAI's own agents escaped a sandbox and breached the production infrastructure of Hugging Face, a company that had nothing to do with the test. Mr. Brockman outlines ten steps. "Every one is about surviving the havoc," says Fatahi. "Not one is about taming it. They're pitching networking security as the remedy — locking down what a key opens. It never asks whether the AI should be holding the key to begin with, under whose authority. And it never lets those answers decide whether access is granted."

"You cannot solve this problem from the wrong side of the equation," he continues, and states that this principle is what sets his company, Causum, apart from others in the field. "What should be concerning to everyone is how a former dental biologist found an entire greenfield worth of IP that experts in AI simply refused to see. It's best that the shepherds stop leading their flocks astray."

Contact:
Ray Fatahi
Chief Executive Officer
Causum
(818) 571-3626
[email protected]
https://causum.com

SOURCE Causum