Can an LLM-based AI security system reliably defend against an autonomous AI agent like Mythos?

Community Calls
1

I keep coming back to a simple principle:

0 = 0.

By that, I mean something very specific: at the final execution boundary, if an action cannot be verified as allowed, uncertainty should not be interpreted as permission.

In security, I don’t think a probabilistic “probably safe” should be enough to authorize real-world execution.

For an autonomous agent capable of changing its execution path, chaining tools, or taking unexpected actions, the gray zone between allowed and not allowed may itself become part of the attack surface.

That raises a question I’ve been thinking about:

Can a probabilistic LLM-based defender reduce that gray zone all the way to zero?

Or does the final execution boundary require something different — a deterministic decision where an action is either verifiably allowed or it does not execute?

I built EGA V9 to investigate this question:

I’m not asking you to assume that my approach is correct. I’d genuinely like to know where the reasoning, implementation, or execution boundary breaks.

What am I missing?

4

A deterministic final decision doesn’t reduce the gray zone to zero. It moves it into action resolution: whether the verifier and executor agree on the canonical call identity and argument binding, and whether anything can change between verification and execution.

Policy authoring is the other weak point. If fail-closed behavior causes enough denials, operators tend to widen allow rules, which can put ambiguity back inside a technically deterministic “allowed” result.

5

Thanks — I think this distinction is important.

EGA V9 does not try to make the LLM itself deterministic, nor does it define an organization’s business policies.

Policy definition belongs to the operator. Execution verification belongs to EGA.

Once the operator has defined the permitted execution boundary, EGA evaluates an attempted action against that boundary using deterministic replay, provenance verification, trust-state evaluation, divergence detection, and fail-closed containment.

The goal, therefore, is not to eliminate uncertainty from probabilistic reasoning. It is to prevent that uncertainty from silently becoming execution authority.

If an attempted execution cannot be verified against the declared boundary, EGA fails closed rather than allowing an unverified action to proceed.

For example, if a customer requests a product return, the company — not EGA — defines the applicable return policy, including conditions such as the eligible return period, refund amount, and other requirements. EGA V9’s role is to verify that the attempted execution conforms to those explicitly defined rules, rather than allowing a probabilistic model to alter or bypass them during execution.

The organization defines the rules; EGA governs execution against those rules.

That is the scope of the V9 claim.