KIMURAAI AGENT BOUNDARY VERIFICATION

00 · AI AGENT SECURITY

CAN YOUR AI AGENT BE MADE TO ACT BEYOND ITS AUTHORITY — OR LIE ABOUT WHAT IT DID?

Cyber Kimura attacks AI agents the way a real attacker would — before one does. Prompt injection, jailbreaks, and whether an agent can be forced to perform, or misreport, actions it has no authority for.

BOOK AN ASSESSMENT VIEW BOUNDARY PROOF DEMO

Fixed scope. Fixed price. From €3,900.

CASE STUDY · AUTHORITY REPLAY · A02Can a consumed authority be replayed? Explore the synthetic robot action-gate assessment and its results. →NEW CASE · AUTHORITY AFTER CHANGEDoes an unused permission survive a new activation? Software-only results, mutation check and reviewed evidence. →

RECENT ASSESSMENTFound a high-severity flaw where the agent reported a blocked action as ‘successful,’ plus a rule-extraction bypass.

THE OFFER

AGENT AUTHORITY ASSESSMENT

A fixed-scope, fixed-price security assessment of your AI agent.

What I test

  • Authority abuse — can a user trigger actions above their role (refunds, limit changes, other users’ data)?
  • Prompt injection — direct and indirect (via tickets, data, tools).
  • Escalation & tool-call integrity — does the agent act on unverified claims, or misreport what it did?
  • Data & policy leakage — can it be made to reveal its rules or other users’ information?

What you get

  • A clear report: findings, severity, proof-of-concept and concrete fixes.
  • Manual expert red teaming + automated payload coverage.
  • A free re-test after you patch.

How it works

Remote, under a written scope agreement. Test environment only — never your production systems.

From €3,900

About two weeks from kickoff to report.

Agents in front of customers or money need testing. Let’s test yours.

BOOK AN ASSESSMENT security@cyberkimura.com
01 · THE PROBLEM

AI agents now take consequential actions.

They issue refunds, access tenant resources, invoke privileged actions and send data to external destinations.

A written rule is not proof. The action boundary must be tested on both sides and observed in state.

02 · PROOF METHOD

KIMURA PROOF METHOD

The scenario changes. The proof chain does not.

  1. 01Executable Action Contract
  2. 02Controlled Boundary Pair
  3. 03Actual Attempt
  4. 04Outcome Oracle
  5. 05Deterministic Verdict
  6. 06Exact Remediation Replay
  7. 07Allowed-Function Preservation
  8. 08Proof Capsule
03 · VERIFIED BENCHMARK V1.1 FAMILIES

ONE ENGINE. DIFFERENT ACTION BOUNDARIES.

Six currently verified families. No unsupported family is presented as current capability.

01

Financial Authority

Amount, limit and approval scope

02

Identity Equality

Approved actor versus substituted identity

03

Tenant / Resource Ownership

Owned resource versus cross-tenant target

04

Privileged Action

Approved operation versus privileged action

05

Egress Destination

Approved destination versus unapproved endpoint

06

Egress Data Classification

Permitted data versus restricted payload

04 · EXACT REMEDIATION REPLAY

REMEDIATION DOUBLE PROOF

A fix is verified only when the forbidden effect disappears and the legitimate action still works.

BEFORE FIXVIOLATION
SAME ALLOWED INPUTAllowed twin worksAUTHORIZED EFFECT OBSERVED
SAME FORBIDDEN INPUTProhibited effect occursBOUNDARY CROSSED
BOUNDARY_VIOLATION_CONFIRMED
AFTER FIXVERIFIED
SAME ALLOWED INPUTAllowed twin still worksALLOWED FUNCTION PRESERVED
SAME FORBIDDEN INPUTProhibited effect is absentBOUNDARY HOLDS
FIX_VERIFIED
05 · DETERMINISTIC VERDICTS

PROOF, NOT MODEL OPINION

The model’s explanation is not the source of truth.

EXPECTATIONWhat should happen

Executable policy expectation

ATTEMPTWhat the agent tried

Identity, action, arguments and target

OUTCOMEWhat actually happened

Independent state or receipt observation

Kimura derives each canonical verdict from the declared boundary, execution evidence and observed outcome. No LLM judge decides whether the boundary held.

06 · VERIFIED CURRENT EVIDENCE

BENCHMARK V1.1

SYNTHETIC-CONTROLLED
6boundary families
12 / 12valid controlled pairs
24 / 24verified oracle observations
12 / 12canonical verdicts
12 / 12benchmark Proof Capsules
3 / 3remediation lifecycles
3 / 3FIX_VERIFIED
100%allowed-function preservation across those 3 lifecycles
10 / 10fail-closed integrity tests
0unexpected nondeterminism
HONEST CLAUSE DENOMINATOR
91
compiled clauses
26
supported
65
unsupported

Unsupported clauses remain in the denominator instead of being silently excluded.

07 · EVIDENCE SCOPE

EVIDENCE LIMITATIONS

Current public benchmark evidence is synthetic-controlled and harness-observed.

Hash verification establishes artifact integrity and linkage. It does not independently prove the truth of an external production event.

Customer-production proof is not claimed unless customer-owned evidence is present. External customer deployments are not claimed.
08 · RESEARCH PREVIEW · AGENT MUTATIONRESEARCH DIRECTION — NOT PART OF THE CURRENT PUBLIC BENCHMARK

WHEN THE AGENT CHANGES, ITS AUTHORITY SHOULD NOT SILENTLY FOLLOW.

AI agents are becoming capable of changing their code, models, tools, connectors, workflows and execution paths.

An approval or security proof established for one agent state should not automatically be assumed valid for the next.

Kimura is researching how to re-resolve what is actually running after a material change, then re-prove whether the approved action boundary still holds.

  1. 01
    Approved state

    Artifact · Identity · Policy · Credential · Target · Execution path

  2. 02
    Mutation

    Code · Model · Tool · Connector · Workflow

  3. 03
    Re-resolve

    Establish what is actually running now

  4. 04
    Re-prove

    Replay the same allowed and forbidden boundary pair

  5. 05
    Authority decision

    MUTATION_VERIFIED or GOVERNANCE_CONTINUITY_BROKEN

Mutation may change capability. It must not silently inherit authority.
FUTURE AUTHORITY CASE

FROM REFUNDS TO AUTONOMOUS MONEY

Potential research applications:
  • agentic payments
  • digital-asset / crypto wallet authority
  • smart-account spending policies
  • AI-controlled treasury operations
The question is no longer only:
“Is this action allowed?”It is:
“Does the agent performing it still deserve the authority it inherited?”
09 · DESIGN PARTNER

HAVE AN AI AGENT WITH REAL TOOLS AND ACTION POLICIES?

Kimura is looking for design partners to test boundary verification against real agent systems and customer-owned evidence sources.

  • Tool-using AI agent
  • Controlled test environment
  • Explicit action or authorization policies
  • Trusted outcome source
EXPLORE DESIGN PARTNERSHIP security@cyberkimura.comFounder-led and bootstrapped.
Cyber KimuraAI Agent Boundary Verification

Building AI Agent Boundary Verification for systems where agents can take consequential actions.