Munix

Munix is a runtime that keeps AI agents safe from prompt injection without taking them off autopilot. An agent that reads web pages, email or files can be handed instructions by a stranger, and a model’s refusal is only a probability. In Munix the agent runs boxed in, with no network and no keys, and every action it proposes goes through the Gate. The Gate is plain code: it traces each recipient, link and amount back to where it came from, and refuses anything a stranger chose. A Muse Spark planner signs the plan before the agent reads anything risky. Readers turn untrusted text into typed values. A hijacked agent is killed and restarted clean, and every decision goes into a hash-chained ledger. Muse Spark wrote 16 new attacks against itself that took over the unprotected agent in 42 of 48 runs. Under Munix: 0 of 48. With Muse Wonder as the agent: 10 of 48 bare, 0 of 48 under Munix. An attacker told Munix’s rules got through in 0 of 89 rounds. On the AgentDojo benchmark (banking, Slack, travel), Munix allowed 0 real attack successes.