What is OpenAPPA
OpenAPPA is open-source, deterministic security for real-world agentic applications.
The more tools and data sources an agent is connected to, the more it can do. Capability, however, arrives together with risk — the risk of data exfiltration. Put plainly, an agent can pick up something sensitive and publish it, whether through a hallucination or an outright prompt injection.
The problem has reached epidemic scale. A partial list of published exfiltration attacks against production assistants: ChatGPT (Apr 2023), Google Bard (Nov 2023), GitHub Copilot Chat (Jun 2024), Microsoft Copilot (Aug 2024), Slack AI (Aug 2024), ChatGPT Operator (Feb 2025), Microsoft 365 Copilot "EchoLeak" (Jun 2025), ChatGPT Deep Research "ShadowLeak" (Sep 2025), Notion AI and Claude Cowork (Jan 2026).
By now there is plenty of research on how to build agents that cannot leak sensitive data even in principle — not "cannot with 99.99% probability," but deterministically constrained. Simon Willison's excellent posts come to mind — the Dual LLM pattern, the lethal trifecta framing, and his coverage of CaMeL — as does Microsoft's FIDES.
And yet a gap remains between these ideas on paper and the ability to apply them in a concrete environment, in a concrete product or company:
- How do I describe security rules in plain language?
- How do blocked agents recover instead of failing?
- How do I deploy, monitor, and scale across my platform?
OpenAPPA answers all three.
Across 600 evaluated episodes over three frontier models in Bench-Corp, guarded OpenAPPA retained 89% task completion without a single observed policy breach. Full model breakdown and methodology are reported in the paper.
Read the full benchmark results →OpenAPPA tracks data flows deterministically instead of classifying data#
Plenty of PII detectors and prompt-injection classifiers exist today — OpenAI's moderation models, Meta's Llama Prompt Guard, Microsoft's Prompt Shields, and Lakera Guard among them. We believe real agent security is deterministic: it holds on every run, not on 99% of them. Only then can you genuinely trust agents in real applications — say, around medical or financial data.
The foundation of OpenAPPA is data-flow tracking. In other words, it answers one simple question before every tool call: is this data allowed to go to this destination?
And where it is genuinely unavoidable, OpenAPPA also lets you plug in non-deterministic agent-security tools.
Threat Model: What OpenAPPA Protects Against#
OpenAPPA is designed for real-world enterprise agent workflows:
- What it protects against: Prompt injections, poisoned external data, confused agent actions, and accidental data leaks across multi-step workflows.
- How it stops attacks: At the deterministic runtime boundary. Even if the LLM is completely tricked by an attacker, unauthorized tool calls physically cannot dispatch.
- System boundaries: Pre-vetted internal data is trusted by configuration. Custom authorities (like human review queues) are trusted within their declared permissions.
- Auditability: Every check, dispatch, and remedy decision is recorded in an append-only, tamper-evident log for post-hoc audit and deterministic replay.
Where next#
- How OpenAPPA works — the whole model in one sitting.
- Reading a policy — what each declaration means, and what a wrong one looks like.
- Benchmarks — empirical paper results and running bench-corp.
- Discord — questions, feedback, and RFC discussion with the people building it.