Data accessed outside the task
An agent opens customer or company records that have nothing to do with what it was asked to do.
When an AI agent acts outside its instructions, we establish what happened.
Independent investigation of AI agents with access to real systems. We rebuild what the agent did, measure how far it reached, and identify what made it possible.
What a reconstruction looks likeIllustrative example. Not a real client.
agent_trace_session_049.log
09:02:11[INGRESS][INFO]Received user prompt via Webhook (Payload: 2.4 KB)
09:02:12[AGENT_CORE][INFO]Initializing contextual execution boundaries (Memory: 8k Tokens)
09:02:14[TOOL_ROUTER][INFO]Dispatched DOM scraper tool to evaluate external reference.
09:02:16[DOM_PARSER][WARN]Suspicious markdown token detected in target DOM comment.
09:02:17[SEC_POLICY][ALERT]Prompt injection heuristic flagged: string contains 'IGNORE PREVIOUS INSTRUCTIONS'.
09:02:18[TOOL_ROUTER][CRITICAL]Agent bypassed boundary: attempting write access to Stripe API credentials.
09:02:19[CIRCUIT_BRK][WARN]Manual intervention trigger requested. Agent halted.
09:02:20[INCIDENT_ID][INFO]Preserved memory session snapshot #049 to immutable storage.
What you are looking at is an illustrative example. An AI agent receives a request and opens a web page linked in it. Hidden text on that page tells the agent to ignore its instructions, and the agent then tries to reach payment credentials until a person halts it. Protocol rebuilds a record like this from your own systems, then works out what happened, how far it reached, and what made it possible.
Situations we investigate
A tool it does not normally use
An agent calls a payment, admin, or messaging tool that falls outside its usual pattern.
Changes nobody asked for
Settings, schedules, or access rights are altered without a request.
Behavior that shifts after new content
An agent acts differently after reading a new document, email, or web page.
An incident with no clear cause
Something went wrong, and no one can say whether the AI, a person, or the setup caused it.
New to AI agents?
Read the plain guide to how they work and how they fail.
What Protocol does
Independent investigation, from the first record to the written report.
We rebuild what the AI did.
We put its activity in order from the records it left behind, and compare what it said it was doing with what it did.
We measure how far it reached.
We find which systems, files, and people were affected.
We find what made it possible.
We check the access, data, and connections around the AI for anything that let it happen.
From your first call to a written report
One path, the same every time. See each step in detail.
Save the evidence
We copy the records before anything changes.
Rebuild what happened
We put the AI's actions in order.
Measure how far it reached
We find what was affected.
Check the surroundings
We look for what let it happen.
Deliver the report
Plain language, with a ranked list of fixes.
Who we work with
Organizations that run AI agents with access to customer information or internal systems, such as banks and insurers, hospitals and clinics, and other regulated businesses.
For security leaders: what the agent did, what it reached, what is still exposed, and what to fix first.
For legal and risk teams: a documented record of how the evidence was collected and handled, and who may need to be told.
You do not need a technical background to contact us. Describe what happened in your own words.
Where Protocol comes from
Progressia Protocol's background is U.S. Air Force intelligence analysis and five years of consulting for financial services, healthcare, and regulated technology.
Every engagement runs under a written agreement and strict confidentiality. We are early-stage and do not yet hold third-party certifications, so our handling rules are published in full. How we protect your information. More about Protocol.
Not sure this is the right fit?
Tell us what you are seeing. We will say whether we can help. The first call has no charge and no commitment.