IronCurtain: an open-source project to keep AI agents from going off the rails

The AI industry is in the middle of a boom in autonomous agents: programs that do more than answer questions and instead act on their own inside a user's digital world, sending emails, booking meetings, editing documents and managing subscriptions. But the more authority an AI gets, the sharper the question becomes: what happens when an agent makes the wrong call? A new open-source project, IronCurtain, covered by Wired, offers an answer, and its approach differs fundamentally from what the big labs are doing.

The problem IronCurtain tackles is not abstract. Over the past year, dozens of companies, from OpenAI and Google to startups such as Adept and Cognition, have released AI agents that can interact with apps and services on a person's behalf. These systems get access to email, banking apps and work tools.

Yet the language models underneath remain probabilistic systems: they can hallucinate, misread an instruction or fall victim to prompt injection, an attack in which malicious text in an email or on a web page makes the agent take an unwanted action. Imagine your AI assistant reading a carefully crafted email and then starting to forward confidential documents to third parties. This is not science fiction; security researchers have already demonstrated such vulnerabilities.

The traditional fix is to build restrictions into the language model itself through system prompts, fine-tuning or RLHF. IronCurtain takes a different route. The project builds an external protective perimeter, a kind of "iron curtain" between the agent's intentions and the real world. Before any action by an AI agent is carried out, it passes through a system of hard rules and policies that cannot be bypassed by manipulating the prompt. This is a deliberate architectural choice: security sits outside the model, where it is not exposed to the same weaknesses as the AI itself.

Technically, it resembles a firewall in computer networks. A firewall does not try to make every program safe from the inside; it controls which traffic passes and which is blocked, regardless of the program's intent. Similarly, IronCurtain intercepts the agent's API calls and system commands, checks them against a set of policies defined by the user or administrator, and lets through only the actions that are explicitly allowed. If the agent tries to send an email to an unfamiliar address, delete a file or make a financial transaction above a set threshold, the action is blocked and the user gets a notification.

Open code is another key part of the project's philosophy. Unlike proprietary security measures built into commercial agents, IronCurtain lets any developer or researcher examine exactly how the restrictions work, look for potential vulnerabilities and suggest improvements. This matters especially amid growing distrust of the "black boxes" of big AI companies. When a system controls AI's access to your digital life, transparency stops being a nice bonus and becomes a necessity.

For the industry, IronCurtain's appearance signals an important shift in thinking. For a long time, AI agent safety was treated as a problem to solve at the level of the model itself: make it "more obedient" and "more cautious." But practice shows this approach has fundamental limits: a model smart enough to be useful is inevitably flexible enough to be deceived. An external security layer that runs on deterministic rules does not replace the model's internal restrictions, but it creates a critically important second line of defense. It is the same "defense in depth" principle that has been used in cybersecurity for decades.

The approach has its limits, though. Rigid rules can reduce an agent's usefulness: if the policy is too strict, the AI assistant turns into a useless program that asks for confirmation on every action. The balance between security and functionality remains an unsolved design problem, and IronCurtain so far offers tools, not universal recipes. The project is also at an early stage, and its real-world resilience against sophisticated attacks has yet to be tested in the field.

Still, the direction is right. As AI agents become an everyday reality, and 2026 is already being called the year of agentic AI, the need for reliable, transparent control systems that are independent of any specific model will only grow. IronCurtain may become the standard around which an entire ecosystem of security tools for autonomous AI forms. And if that happens, we will remember this project as the moment the industry finally admitted that trusting an agent does not mean trusting it blindly.