SkyDaemon is built on published research. As we mature toward general availability, we plan to share original detection methods, adversarial-ML benchmarks, and long-form work on AI security and governance. SkyDaemon is in beta — the work below describes research directions we're developing, not yet published papers.
Previews of methods and detection research we're actively developing. These describe directions and designs — not yet peer-reviewed or published papers. Request early access to follow the work.
We are developing a runtime architecture designed to distinguish AI-agent actions whose intent originates from authenticated user input from those whose intent originates from untrusted retrieved content. The system attaches a provenance trace to every tool call, mapping it back to the conversational segment that triggered it. Privileged actions whose provenance maps to non-user-turn content are flagged as confused-deputy events.
Atomic adversarial-ML detectors miss the multi-stage attacker objective. We are developing a graph-walk algorithm over agent-invocation traces that surfaces composite kill-chains: indirect-injection → confused-deputy → external-action; secret-in-input → markdown-image-exfil → confirmed-egress; and reconnaissance → jailbreak → harm-output. It is designed to lift attack visibility from atomic-detector coverage toward full composite kill-chain coverage.
Documents the SkyDaemon three-tier detection architecture designed to cover 104 natural languages: native fine-tuned classifiers (Tier 1), multilingual XLM-R-based classifiers (Tier 2), and NMT-bridge classifiers (Tier 3). Includes the eval-harness construction methodology, code-mixed handling for Hinglish / Spanglish / Manglish, and homoglyph normalization (UTS #39). Tier 3 is designed to add minimal additional detection latency.
Auto-rendered markdown in chat clients (Slack, Teams, internal portals) silently fetches embedded image URLs. Attackers exploit this by tricking the model into emitting an image tag whose src is an attacker-controlled domain, with conversation context encoded in the query string. We characterize the attack surface across popular chat platforms, describe a first-class detector, and propose mitigations.
A KS-test-based continuous monitor for output-distribution drift, supplemented by an hourly golden-set probe that tracks response-embedding similarity. Designed to detect silent provider model swaps (a documented pattern in 2025–26 hosted APIs) within minutes of onset.
Cost-anomaly in agentic systems has been treated exclusively as a FinOps concern. We argue for elevating it to a SOC-grade event with a dollar-denominated cost threshold, propose detection thresholds rooted in tenant-baseline + 4σ analysis, and describe a circuit-breaker policy template that can auto-suspend agents on critical-severity DoW.
Datasets and tooling we plan to release openly as SkyDaemon matures. Not yet available — request early access to be notified.
A planned multilingual adversarial benchmark spanning 104 natural languages — direct injection, jailbreak, indirect-injection, content-harm — tier-tagged for evaluating multilingual classifier coverage. Intended for open release under a permissive license.
A planned scored corpus of public Model-Context-Protocol servers. Per-server: signed-binary status, code-provenance score, capability scope, network destinations, age, maintainer reputation. Intended as the foundation for a SkyDaemon MCP reputation API.
The eval harness SkyDaemon is building — designed to support import of PyRIT, Garak, Promptfoo, Inspect AI, HELM, LM Eval Harness, BIG-bench, and the AI Verify Foundation toolkit, so you can run custom probes against a SkyDaemon-instrumented agent. Planned for release under a permissive open-source license.
SkyDaemon's design draws on the following external research and standards bodies:
