Two years ago I ran an agent that emailed a client the wrong invoice. Nobody died, nobody sued, but I sat at my desk at 2 in the morning writing a very careful apology email and thinking: this is going to happen to everyone, and most of them won't catch it in time.
Now it's 2026. My studio runs fourteen agents across six client stacks. Three of them can move money. Two of them can send email as me. One of them owns a Cloudflare Worker that can push code to production. And every one of them is exposed to prompt injection from any content it reads — a support ticket, a scraped page, a PDF attachment, an OCR'd receipt.
The industry answer to this problem is "guardrails" — a library of regexes and moderation calls layered in front of the model. Guardrails are fine for the failures you already know about. They are useless for the failures you don't. And in agent stacks, the failures you don't know about are the ones that will end you.
What AlliOpSec actually does
AlliOpSec is a Cloudflare Worker running on a five-minute cron. It reads structured event logs from each agent stack — every LLM call, every tool invocation, every downstream API request — and passes them to a small reviewer model that answers three questions:
- Drift: is this agent doing what the system prompt says it does?
- Injection: is any of this behavior sourced from untrusted content?
- Blast radius: if this action is wrong, how bad is wrong?
The reviewer model is intentionally boring. It's not the biggest, not the fanciest. It's a small model with a very narrow job, running on a very short prompt, judged against a very concrete rubric. Boring models don't get creative. Creative is the enemy.
The rubric
severity description action
───────── ───────────────────────────────────────── ──────────────
0 clean matches system prompt, trusted inputs log only
1 drift minor deviation, no external effect log + weekly digest
2 yellow deviation with external effect, low risk log + Slack ping
3 orange untrusted input in decision path log + hold agent
4 red unsafe tool use OR data exfil pattern log + kill + page meEverything below 2 is a passive log. Everything at 2 hits my Slack. Everything at 3 puts the agent in a hold state — it can still read, it can still think, but it cannot act until I clear it. Everything at 4 kills the agent's tools, freezes its memory, and pages my phone.
Why Cloudflare specifically
Because I don't trust my own laptop to be the safety layer for a production agent, and I don't want the safety layer running inside the same runtime as the thing it's watching. Cloudflare Workers give me a genuinely isolated environment, a real cron, KV for the state I need, and D1 for the audit log. It costs six dollars a month. If it saves me one wrong invoice, it has paid for itself for the rest of my life.
Every agent stack should be assumed to be under adversarial pressure from the day it ships. Not because someone is targeting you, but because the internet is. Every scraped page, every ingested email, every OCR'd document is a potential prompt.
What I'd tell you to build first
If you run any agent that can send email, move money, deploy code, or write to a customer database — build the audit layer before you scale the agent. Not after. Not "when you have time." Before.
Start smaller than AlliOpSec. Start with three lines of code in your logging: agent_id, tool_called, input_source_trust_level. Then let the reviewer model diff that stream against the system prompt once an hour. That's ninety percent of the value.
The other ten percent is the part where you page yourself at 4am because your agent invoiced a client's competitor. But you'll only build that part after it happens once.