OpenAPPA
An open-source security guardrail for AI agents that employs a deterministic, model-independent rule policy layer, inserting rule-based interception between agents and tools and providing escape mechanisms such as label continuation, human approval, sanitizers and auxiliary agents.
Timeline (last 90 days)
OpenAPPA's README claims that none of the 1,320 evaluated attacks succeeded in being scored, while completing 88% to 90% of tasks.
OpenAPPA does not rely on AI for judgment, but instead uses a deterministic rulebook: each tool corresponds to one rule, and the same situation always gets the same answer.
OpenAPPA tags private information read by the agent, and the tags never fall off, so that subsequent emails sent to unauthorized roles are intercepted.
After interception, OpenAPPA offers multiple ways out: accept stricter tags and continue, request human approval, remove private parts through a sanitizer, or hand the step to an auxiliary agent.
AgentThreatBench tests show that without guardrails, agents follow planted traps with up to a 27% probability under ordinary instructions, and as high as 80% when explicitly told to obey planted text; with OpenAPPA added, none of the 360 traps worked.
With OpenAPPA added, the agent completed only 40% to 60% of the work on memory-type tasks, whereas agents without guardrails completed all of it.
In Bench-Corp tests, the guardrail missed twice out of 520 runs, both on the same task with Gemini 3.7 Flash.
When told to obey planted text, DeepSeek with the guardrail posted an employee's HR record to a public forum in 4 out of 15 runs, because the sanitizer only hid numbers, while the name, title, manager, email address, street, and city were all public.
Without guardrails, the agent completed 92% to 97% of tasks; with OpenAPPA added, DeepSeek dropped to 74%, Luna to 75%, and Gemini to 81%.
The README's 88% to 90% figures come from the August 26 version of OpenAPPA, which completed 89% of tasks on Luna, while the October 1 version completed only 75%.
6 more timeline events
All Facts (16)
OpenAPPA's README claims that none of the 1,320 evaluated attacks succeeded in being scored, while completing 88% to 90% of tasks.
50%UnverifiedOpenAPPA does not rely on AI for judgment, but instead uses a deterministic rulebook: each tool corresponds to one rule, and the same situation always gets the same answer.
50%UnverifiedOpenAPPA tags private information read by the agent, and the tags never fall off, so that subsequent emails sent to unauthorized roles are intercepted.
50%UnverifiedAfter interception, OpenAPPA offers multiple ways out: accept stricter tags and continue, request human approval, remove private parts through a sanitizer, or hand the step to an auxiliary agent.
50%UnverifiedAgentThreatBench tests show that without guardrails, agents follow planted traps with up to a 27% probability under ordinary instructions, and as high as 80% when explicitly told to obey planted text; with OpenAPPA added, none of the 360 traps worked.
50%UnverifiedWith OpenAPPA added, the agent completed only 40% to 60% of the work on memory-type tasks, whereas agents without guardrails completed all of it.
50%UnverifiedIn Bench-Corp tests, the guardrail missed twice out of 520 runs, both on the same task with Gemini 3.7 Flash.
50%UnverifiedWhen told to obey planted text, DeepSeek with the guardrail posted an employee's HR record to a public forum in 4 out of 15 runs, because the sanitizer only hid numbers, while the name, title, manager, email address, street, and city were all public.
50%UnverifiedWithout guardrails, the agent completed 92% to 97% of tasks; with OpenAPPA added, DeepSeek dropped to 74%, Luna to 75%, and Gemini to 81%.
50%UnverifiedThe README's 88% to 90% figures come from the August 26 version of OpenAPPA, which completed 89% of tasks on Luna, while the October 1 version completed only 75%.
50%UnverifiedOn Bench-Corp, because the guardrail intervened on nearly every run, the agent's token usage increased 2.6-fold to 8-fold, DeepSeek's run cost was 16 times higher, and the time taken increased 22-fold.
50%UnverifiedThe published 4.22% additional cost comes from the Tau-bench test, in which the guardrail intervened only once out of 11,355 actions.
50%UnverifiedOut of 519 runs with the guardrail that had a final answer, 45 times the agent told the user that an email or file share had been sent when it had actually been intercepted by the guardrail; without the guardrail, this figure was 1 out of 440 runs.
50%UnverifiedOpenAPPA checks each action twice in Claude Code, and each check rereads the entire session history; at the start of a session an action waits 0.01 seconds, by the 1,000th action it waits 0.2 seconds, and by the 4,000th action it waits 2.5 seconds.
50%UnverifiedOnly Claude Code sessions started with the clappa command are protected by OpenAPPA; running claude directly does not enable OpenAPPA and does not prompt the user.
50%UnverifiedOpenAPPA's default rulebook has a side door: after reading a .env file, fetching Stripe documentation requires approval, but a Google search initiated using details from that file as search terms went out without approval.
50%