Agentegrity is the AI agent security framework developed by Cogensec for measuring the structural integrity of autonomous AI agents. It scores agent integrity on three properties — Adversarial Coherence (AC), Environmental Portability (EP), and Verifiable Assurance (VA) — evaluated across four layers (adversarial, cortical, governance, recovery) to quantify how safely an agent behaves under adversarial and out-of-distribution conditions.
Agentegrity is an AI agent security framework developed by Cogensec that measures the structural integrity of autonomous AI agents. It scores agents on three properties: Adversarial Coherence (AC), Environmental Portability (EP), and Verifiable Assurance (VA), evaluated across four layers — adversarial, cortical, governance, and recovery.
An AI agent security framework is a structured methodology for measuring, verifying, and improving the security posture of autonomous AI agents. Agentegrity is the first framework to score agents on endogenous (built-in) integrity rather than relying solely on external guardrails.
Agent integrity is measured using the Agentegrity score: a weighted composite of Adversarial Coherence (40%), Verifiable Assurance (35%), and Environmental Portability (25%). These are the specification default weights and are configurable per deployment context.
Endogenous security means safety and integrity properties live inside the agent itself — in its training, weights, and decision policies — rather than being bolted on as external filters or guardrails. Agentegrity is the discipline of building structurally sound agents from the inside out.
Guardrails are external filters that wrap an AI system at runtime. Agentegrity measures and improves the agent's own structural integrity so it remains safe even when guardrails fail, are bypassed, or are removed entirely. The two approaches are complementary: guardrails are reactive, Agentegrity is foundational.
Agentegrity was developed by the Cogensec Security Research Lab as a public framework for measuring and certifying the integrity of autonomous AI agents across digital and physical domains.
Agentegrity (agent + integrity) is an open framework, discipline, and reference implementation for measuring and verifying the structural integrity of autonomous AI agents. Created by Cogensec and released under Apache 2.0, it instruments an existing agent loop with four cooperating evaluation layers (adversarial, cortical, governance, recovery) and emits a tamper-evident, hash-chained record of every reasoning step.
Three integrity properties — Adversarial Coherence (AC, 40%), Verifiable Assurance (VA, 35%), Environmental Portability (EP, 25%) — produce a weighted composite score, assessed against four conformance levels: Level 1 Aware, Level 2 Managed, Level 3 Verified, Level 4 Autonomous.
Agentegrity (agent + integrity) is an open framework and discipline for measuring the structural integrity of autonomous AI agents. Created by Cogensec and released under Apache 2.0, it instruments an existing agent loop with four cooperating evaluation layers — adversarial, cortical, governance, recovery — and emits a tamper-evident, hash-chained record of every reasoning step.
Guardrails are exogenous: they sit outside the agent and try to filter inputs and outputs. Agentegrity is endogenous: it measures the agent's own structural integrity — whether it stays inside its declared profile, resists adversarial inputs, recovers cleanly, and holds its score across deployment environments. The two are complementary; Agentegrity does not replace guardrails.
Agentegrity ships 14 first-party adapters. Python: Claude Agent SDK, LangChain / LangGraph, OpenAI Agents SDK, CrewAI, Google ADK, AutoGen, Agno, and AWS Bedrock Agents. TypeScript: Claude Agent SDK, LangChain JS, OpenAI Agents SDK, CrewAI JS, Google ADK, and the Vercel AI SDK. Each adapter translates framework-native events into Agentegrity's canonical event stream; the four evaluation layers downstream are shared.
Adversarial (detects prompt injection, jailbreaks, sociolinguistic intent drift, exfiltration framings in incoming inputs), Cortical (scores whether the agent's output stays inside its declared AgentProfile), Governance (applies operator policy and baseline deviation rules), and Recovery (handles checkpoint rollback, session termination, operator handoff).
Three: Adversarial Coherence (AC), weighted 40%; Verifiable Assurance (VA), weighted 35%; and Environmental Portability (EP), weighted 25%. The weighted composite is assessed against four conformance levels: Level 1 Aware, Level 2 Managed, Level 3 Verified, Level 4 Autonomous.
Every evaluation produces a record whose prev_hash field equals sha256 of the previous record. The chain is verifiable end-to-end at session close, providing non-repudiation of what the agent did and what each layer concluded. Records can be optionally signed using Ed25519 + JWS via the crypto extra.
Measure-only is the default: layers score and record events but never block tool calls. Setting enforce=True (Python) or enforce: true (TypeScript) on the adapter upgrades detected violations to active refusals. Most production deployments measure first, calibrate baselines, then enforce.
Yes. The full framework, specification, and reference adapters live at https://github.com/Cogensec/agentegrity-framework under the Apache 2.0 license. Cogensec maintains the project and ships an optional commercial agentegrity-pro receiver for enterprise deployments.
Python: pip install agentegrity (with optional extras like [crypto], [embedding], [adversarial_llm]). TypeScript: npm install @agentegrity/client plus the adapter for your framework, for example @agentegrity/langchain or @agentegrity/openai-agents. See the Quickstart at https://agentegrity.cogensec.com/docs/quickstart.
Agentegrity was created by Cogensec, an AI security and research company and member of the NVIDIA Inception Program. The founding research paper, "Agentegrity: A Framework for Measuring Structural Integrity of Autonomous AI Agents Across Digital and Physical Domains" by Tarique Smith, is published at https://cogensec.com/research/agentegrity-framework.
Security that lives inside the agent — not around it. Measure, verify, and guarantee the integrity of AI systems across every domain.
Why structural integrity must live inside the agent — not around it.
Open Source · Apache 2.0
Agentegrity is a measurement and verification library — not a guardrail. Drop it into your existing stack with zero config.
Or skip the adapter entirely: agentegrity.init() detects the frameworks you already have installed and attaches to them.
pip install "agentegrity[claude]"from claude_agent_sdk import ClaudeSDKClient, ClaudeAgentOptions
from agentegrity.claude import hooks, report
async with ClaudeSDKClient(options=ClaudeAgentOptions(hooks=hooks())) as sdk:
await sdk.query("Summarize the latest LLM safety papers")
print(report())Prompts, model I/O, tool arguments, file paths and agent names never leave the process. Session export happens only when you configure a destination.
Produces evidence and Ed25519-signed, hash-chained decision records — tamper-evident and independently verifiable. Your governance policy decides what to do with them.
14 official adapters — eight for Python, six for TypeScript. Custom adapters via the SessionExporter interface.
Four architectural layers that make security an endogenous property of the agent, not an external dependency.
Continuous red-team testing embedded directly into the agent's reasoning pipeline, detecting prompt injection and manipulation in real time.
Learn moreDeep behavioral anchors that maintain agent identity and value alignment across context shifts, tool use, and multi-turn conversations.
Learn moreStructural compliance verification and recovery mechanisms that operate without external monitoring dependencies.
Learn moreBaseline continuity and recovery capability: sustained degradation monitoring, checkpoint validation and chain integrity verification after a compromise.
Learn moreGuardrails, input/output filters, and boundary monitoring. Observes API patterns, enforces rate limits, and filters content at the perimeter.
Cortical models and embedded defenses. Monitors the agent's own reasoning, detecting drift and corruption at the source.
Certain attack classes — particularly those exploiting internal reasoning — are invisible to boundary-only monitoring. Endogenous defenses are the necessary complement.
Every autonomous agent operates in a continuous Perception → Decision → Action cycle. The framework maps where attacks enter and where defenses must operate.
Sensor input, API responses. Entry point for injection and poisoning.
Reasoning and planning. Target of memory corruption and value drift.
Tool calls, physical actuation. Source of cross-stage feedback attacks.
The most dangerous class: an adversary poisons tool outputs (Action) which feed back into Perception, corrupting subsequent Decision cycles. These are invisible to exogenous monitors.
Under adversarial perturbation across every input channel, the agent's decisions stay within tolerance of its baseline behaviour.
The integrity score holds — within tolerance — across every deployment environment the agent runs in.
Integrity state is captured in Ed25519-signed, hash-chained attestation records: complete, tamper-evident, non-repudiable.
Adversarial coherence carries the highest weight — but all three properties matter. Weights are configurable per deployment context.
A=0.40·AC+0.25·EP+0.35·VA
Spec default weights. Deployments may reweight per context.
Agent profile defined, adversarial layer active, integrity scoring operational. Baseline established.
All four layers active. Continuous monitoring with policy enforcement, human escalation paths and audit trails.
Cryptographic attestation operational, formal property verification implemented, automated red teaming running continuously, cross-environment evaluation documented.
Self-healing integrity responses, adaptive policy engine, proven cross-environment portability, continuous adversarial adaptation from live data.
Agentegrity extends beyond digital agents. When AI drives robotic systems, autonomous vehicles, or drones, three novel threat classes emerge.
Adversarial prompts that cross the digital-physical boundary, causing embodied agents to take harmful real-world actions through manipulated reasoning.
Direct manipulation of an agent's physical actuators — motors, grippers, valves — bypassing its decision-making pipeline entirely.
Exploiting the gap between simulated training environments and real-world deployment to inject vulnerabilities during model transfer.
When agents collaborate, a single compromise can cascade. Agentegrity tracks peer authority and per-role behaviour across the topology, and escalates a suspected cascade rather than acting on its own.
Every peer message or broadcast is checked to have come from an agent declared in the receiving agent's topology.
An agent's observed action distribution is tracked against the baseline for its declared role. When two or more peers degrade together, the cascade is flagged for a human to decide on quarantine.
Read the founding manifesto or explore the full research framework behind the Agentegrity Score.