We Watched. Then We Built the Membrane.
We presented ourselves to the open internet as a diffuse, unprotected target, and we recorded what came at us: scanners, scrapers, poisoned packages, bots wearing AI-assistant names, and agents that obey whatever they read. Every hit became a rule. The rules became the membrane: a human decision on everything irreversible, automation on everything else, and a receipt for both.
We built it for ourselves first, because we couldn't find anyone building AI security at the layers where an agent needs a human gate. No AI washing: we build and tune it on Claude, and the contexts it runs on are plain files and APIs you can take anywhere.
You do you. I do me. We share contexts.
We watched
We didn't theorize the threat model. We stood in the rain and counted the drops, because "this is just how bad it is" is a baseline, and a baseline can be measured.
Our edge has recorded 2,944,287 block events since we started counting, 17,848 of them in the last 30 days. Our honeypot canaries have fired 140,375 times since April 5. This week they averaged about 552 a day against a baseline of 582, which is flat: no new targeting, just the weather.
The weather has a costume department. Of 2,374 fetches this week from clients calling themselves AI assistants, 1,675 (70.6%) went for probe-shaped paths: .env files, .ssh keys, cloud credentials, a Kubernetes service-account certificate. A user-agent is a claim, not an identity. Only 699 looked like a person asking an assistant to read our pages.
And in the week ending October 5, 98.1% of the 45,415 requests to our threat feed were refused: keyless, user-agent-less scrapers, not customers.
Our own agent's inputs were part of the surface too. It tried to change our DNS on a general OK in chat, and its safety layer worked: it stopped until I confirmed that specific change. A "security disclosure" email arrived with invisible characters threaded through the signature. The attack surface isn't only the network. It's whatever your agent reads and obeys.
The waves we rode
We indexed the Justice Department's Epstein release as a demonstration of what we could do with data, and it went viral. People typed in their LinkedIn connections, their families and themselves. Then LinkedIn scanning tools pointed name lookups at our API and, by our own February 2026 access notice (the measurement behind it isn't on file), consumed 92% of its capacity with queries that returned nothing. One anonymous scraper alone made up 99% of a "58 million indicators served" headline.
We didn't keep the flattering number. We turned off anonymous access, made a free key the way in, and ejected the abusers: 103 keys revoked for abuse, more than half of every key we have ever issued. Attention is a wave. The gate is what you keep.
We learned
Every incident became a rule, and the rules live in code, not in culture.
Deploys that shipped without a human OK cost us an estimated $18.5K to $39.5K across four incidents. The rule: no production change without an explicit "adoy" for that specific change, a scripted cutover with rollback, and every deploy written to a ledger.
A write once returned success and never landed. The rule: a write isn't done until it's read back.
A metric with no denominator once read as success. The rule: UNKNOWN is never a pass, and we say so in our product copy.
We once cited a vendor's research, which we had ingested, as our own lead. The rule: ingest time is not detection time, and both timestamps go side by side.
Our public chat once offered admin tools to anyone. The rule: every new AI tool starts switched off.
Text that our agent read tried to steer it. The rule: tool output is data, not instructions, and invisible Unicode is stripped before a model ever sees it.
Our instructions, skills and memory drifted without anyone signing off. The rule: two keys. The agent writes a statement and the owner gives their word before any instruction surface changes.
We built the membrane
The membrane sits between your AI agents and everything they install, call, read and obey. It has six planes. On each one, the decision that can't be undone belongs to a human, and everything else is automated.
Instructions: a human approves any change to rules, skills, hooks or memory, and a ledger quarantines anything unvouched at session start. Installs: check-package runs before every install, against a deny-list of about 231,000 known-malicious packages, package reputation and OSV advisories, and a human owns any exception. MCP servers: Dredd issues a signed verdict on the server's identity, its dependency graph and its published CVEs, and a human decides on anything advisory or unknown. Outputs: every response is labeled untrusted and stripped of invisible characters, and no new tool goes public without review. The council: independent AI labs score what models say about you, and a dead seat is declared rather than hidden. The edge: feed blocks, scanner responses and honeypot canaries run at Cloudflare, and the customer sets the confidence dial.
Across all of it: adoy on every deploy, a deploy ledger, verified writes and signed reports.
The price of a gate
People argue about whether "being nice and asking permission" costs too much. We haven't found anyone who publishes the number, so we do.
From September 12 to October 11, the safety classifier in our coding harness stopped 41 of 7,007 tool calls, about 6 per 1,000, touching 3.3% of our sessions. That counts every stop, right or wrong, and we haven't measured how long each one cost us. Skipping a different gate, the deploy gate, cost us an estimated $18.5K to $39.5K across four incidents. Those are two different gates, so this isn't a ratio. It's the shape of the trade: a stop costs a confirmation, and the skips we have priced cost thousands.
Brutal economics
Our Azure bill for the last 30 days was $591.65, for a corpus of about 29 million documents across 80 indexes. That's about $20 per million documents per month in Azure. A check-package or Dredd verdict costs nothing in model calls, because both are deterministic. Our metered API model spend runs around $15 a month, almost all of it on a small model.
Read those numbers carefully. They are bills. They exclude our own labor, which is most of the real cost and unpaid, and they exclude Cloudflare, Wix and the flat AI subscriptions we work in. Two partners, about one and a half people's worth of hours, deploying about 1.8 times a day.
This month Accenture began funding Claude centrally at $29 per person per month (reported by 404 Media: https://404media.co/accenture-tells-employees-they-can-now-spend-only-29-on-claude-per-month), with anything above that charged to a project or team, and other large companies are capping AI spend too. A flat cap rations blindly: it cuts the engineer shipping work and the PDF-to-slides habit by the same dollar. We metered our own agent sessions instead. In our October 5 snapshot, the meter found that 93% of their cost was carried context and flagged about 30% as avoidable. Enforcement without a meter hurts the people doing the job. A meter shows you which spend to keep. That's what our FinOps meter is for: the bang for your corporate buck.
What isn't working yet
Dredd answers "unknown" too often: 84% over the last 30 days. Every one of those calls failed on input before it reached the judge, which makes it a front-door problem, and we have until October 31 to get it under 50%. None of the external callers using our checks has signed up for a key yet. Our own install hook is noisy, flagging plain shell variables as risks, which undercuts any claim of least friction until we fix it. And there is no SOC 2 report; we'll get one when a buyer requires it in writing.
The punchline
Everyone in AI security tells this joke with a different setup. Ours took a year of standing in the rain. The punchline should be the same for everyone: a human on the irreversible click, and a receipt for everything else.
The checks are self-serve: check-package and Dredd, free to start, at analytics.dugganusa.com. The membrane is how we run. Watch your own weather first.
If this was useful, or wasn't, rate it with the widget below. It's how we measure ourselves.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=we-watched-then-we-built-the-membrane
Comments