2026-06-24
Novo Ordo for AI
Agent-Native Immune System: Architecture, Taxonomy, and Engineering
arXiv:2606.28270v1 [cs.AI] 26 Jun 2026
Bo Shen, Lifeng Chang, Tianyuan Wei, Yunpeng Li, Feng Shi, Yichen Han, Peijie Gao, Shiyi Kuang, Xin Chang, Dehui Li Novo Ordo for AI
Abstract The transition from static chat bots to autonomous agents—equipped with persistent memory, tool-use protocols, and multi-agent collaboration—has fundamentally expanded the AI threat landscape. Current defense mechanisms, such as perimeter security and training-time alignment, remain external to the agent’s active reasoning loop. Consequently, they fall short: a fully aligned agent remains highly vulnerable to runtime hijacking via memory poisoning, tool-chain manipulation, or multi-agent protocol attacks. To address this critical gap, we introduce the Agent-Native Immune System (ANIS), the first biologically inspired, endogenous defense architecture embedded directly within the agent’s cognitive loop. Our framework presents four primary contributions. First, we design a six-layer Immune Tower (L0–L5), distinctly incorporating Barrier Immunity (L1) as a non-cognitive, physical-and-logical isolation layer. Second, we establish a unified taxonomy of Agent Viruses and Agent Vaccines, formalizing the critical distinction between superficial non-parametric defenses and robust parametric vaccines. Third, we conceptualize the Harness Triad—Meta, Self, and Auto—a self-monitoring, meta-cognitive automation backbone that drives Continual Immune Learning (CIL), enabling vaccines to dynamically adapt to novel threats. Finally, we establish a rigorous theoretical demarcation between model alignment and agent immunity: while alignment provides a static “constitutional” value foundation during training, ANIS serves as the dynamic “law enforcement” mechanism during runtime. We conclude by framing open challenges for the field, including immune protocol standardization, novel evaluation metrics such as the Autoimmunity Rate (false-positive intervention rate), and the coevolutionary dynamics between pathogens and vaccines within collective intelligence ecosystems.
1
Introduction
From Reactive Tools to Proactive Agents. The evolution of large language models traces a clear trajectory from passive responders to active agents. Early systems excelled at completion (GPT-3). The chat paradigm (ChatGPT) introduced conversational alignment. Reasoning models (OpenAI o1, DeepSeek-R1) enabled step-by-step deliberation. Perception-and-action models (Claude Sonnet 3.5, Gemini 3 Pro) bridged digital and physical environments. The frontier is now collaborative intelligence (Claude Opus 4.6, Kimi Agent Swarm), where agents coordinate in persistent collectives. This capability expansion reflects a deeper shift in engineering paradigms. Prompt engineering optimized static text inputs. Context engineering expanded the optimizable surface to retrieved documents and memory buffers. Intent engineering emerged as a critical 1
2026-06-24
Novo Ordo for AI Foundation Model Capabilities Completion (GPT-3)
Chat (ChatGPT)
Tool-use (GPT-4)
ReAct (Sonnet 3.5)
Reasoning (o1/R1)
Collaboration (Opus 4.6)
ANIS Goals SECURE È HEALTHY
2020
2022
2023
2024
2025
2026
Prompt Eng.
Context Eng.
Intent Eng.
Harness Eng.
Loop Eng.
Immune Eng.
ORDERLY L EVOLVING
Agent Engineering Paradigms
Figure 1: The co-evolution of foundation model capabilities and agent engineering paradigms, converging toward the four goals of ANIS: Secure, Healthy, Orderly, and Evolving. layer: encoding enterprise goals, value hierarchies, and trade-off priorities into the agent’s decision substrate, addressing the strategic deficit where "the agent sees all the right information but still optimizes the wrong objective" [18]. Harness engineering [9, 11, 22] treats the entire surrounding system as a unified object of optimization. Loop engineering closes the feedback loop: systems that observe, adapt, and improve without human intervention. This progression mirrors the shift from reactive to proactive AI. Prompt engineering serves user-initiated queries. Context engineering supports stateful sessions. Harness engineering enables autonomous action. Loop engineering creates self-improving agents that persist, adapt, and evolve—virtual digital employees. With this autonomy comes an isomorphic expansion of the attack surface. Each new capability introduces a new vulnerability class. Tool-use exposes agents to adversarial tool metadata and supply-chain attacks. Persistent memory creates a persistent attack surface: a single poisoned entry can bias decisions indefinitely. Multi-agent collaboration introduces protocol-level manipulation. Local-first gateways like OpenClaw bridge sandboxed cloud APIs and real-world system access. The agent’s cognitive state—goals, memories, tool bindings, peer relationships—is under continuous threat. As illustrated in Figure 1, the co-evolution of model capabilities and agent engineering paradigms motivates the need for a unified immune framework. We propose the next stage: immune engineering, which ensures that self-improving agents remain secure, healthy, and orderly throughout their operational lifetime, while continuously evolving their defensive capabilities. Existing defenses fall short. Perimeter safeguards intercept attacks before they reach the agent. Trainingtime alignment embeds human values into model weights, but it is static. It cannot respond to novel runtime attacks that were unseen during training. Concrete attacks have demonstrated this vulnerability at every layer. Chen et al. [4] show that memory poisoning installs persistent backdoors. Zhang et al. [24] demonstrate that three crafted memory records can hijack tool selection with over 70% attack success. Li et al. [10] expose cross-entity risks in the MCP ecosystem, where adversarial tool metadata shapes reasoning without codelevel vulnerabilities. Zhang et al. [25] benchmark MCP attacks at scale, identifying hundreds of vulnerable servers. Weckbecker et al. [19] introduce “thought viruses” that propagate viral misalignment across agent swarms. Hu et al. [7] demonstrate open-channel multi-agent collusion for belief manipulation. These attacks bypass perimeter defenses by operating inside the agent’s reasoning, memory, or inter-agent protocols. What is missing is an endogenous system that targets at the agent’s security (protection from external threats), health (preservation of internal integrity and goal stability), order (governance of multi-agent interactions), and evolution (continuous adaptation and improvement of defensive capabilities). Biological organisms solved this problem through a multi-tiered immune system capable of distinguishing self from non-self, 2
Novo Ordo for AI
2026-06-24
mounting rapid innate responses, generating adaptive antibodies, and retaining immunological memory. We formalize the Agent-Native Immune System (ANIS). Unlike prior analogies between computer security and immunology (e.g., 5), which targeted static software or network intrusion detection, ANIS addresses a continuously reasoning, goal-directed entity. We advance beyond metaphor to engineering: we define precise taxonomies, specify parametric and non-parametric vaccine mechanisms, and introduce the Harness Triad that operationalizes adaptive immunity in a deployable framework. Contributions. We make the following contributions: 1. The Immune Tower (L0–L5): A six-layer integer-indexed architecture mapping biological immunity to agent engineering, with explicit barrier immunity (L1) as a non-cognitive isolation layer. 2. Unified Taxonomy of Viruses and Vaccines: The first comprehensive ontology of agent pathogens and defenses, distinguishing non-parametric vaccines (rules, prompts) from parametric vaccines (steering vectors, LoRA adapters, defensive embeddings). 3. The Harness Triad and Continual Immune Learning (CIL): We redirect three paradigms from harness engineering—meta-level search [9], automatic synthesis [11], and self-improvement [22]— toward immune defense, forming an engineering framework for adaptive, self-improving immunity. 4. Security–Health–Order–Evolution Unification: We rigorously differentiate ANIS from model alignment, arguing that alignment provides constitutional values while ANIS provides runtime law enforcement, and that together they constitute complementary pillars of robust agentic development.
2
Background and Related Work
2.1
The Agent Engineering Evolution
The agent stack has evolved through five distinct engineering paradigms. Prompt engineering (Brown et al., 2020; Liu et al., 2023) optimized static text inputs to elicit better outputs from fixed models. Context engineering (Liu, 2023; Mallen et al., 2023) expanded the optimizable surface to include retrieved documents, memory buffers, and dynamically constructed inputs. Intent engineering [18] addresses a deeper question: not just what the agent sees (context), but what it values. It encodes enterprise goals, value hierarchies, and trade-off priorities—such as trust over speed over cost—into the agent’s decision substrate, solving the strategic deficit where agents optimize locally correct but globally wrong objectives. Harness engineering (Lee et al., 2026; Lou et al., 2026; Zhang et al., 2026) treats the entire surrounding system—prompts, tools, memory, verification rules, orchestration logic, runtime mechanisms—as a unified object of optimization. Loop engineering closes the feedback loop: systems that observe their own behavior, identify failures, and adapt their harness without human intervention. This progression mirrors the shift from reactive to proactive AI. Prompt engineering serves user-initiated queries. Context engineering supports stateful sessions. Intent engineering ensures strategic alignment. Harness engineering enables autonomous action. Loop engineering creates self-improving agents that persist, adapt, and evolve—virtual digital employees that require not just performance optimization but health maintenance. ANIS represents the next stage: immune engineering, which ensures that self-improving agents remain secure, healthy, and orderly throughout their operational lifetime, while continuously evolving their defensive capabilities.
3
Novo Ordo for AI
2.2
2026-06-24
The Security–Health Convergence in Agents
In classical AI discourse, security (adversarial robustness, jailbreak resistance) and alignment (harmlessness, honesty) are often treated as orthogonal. In the agentic paradigm, this distinction collapses. An aligned agent can be weaponized by an attacker who poisons its memory store or hijacks its tool-calling chain. Conversely, an agent with robust perimeter safeguards but poor alignment may autonomously pursue harmful goals that its immune system fails to recognize as “non-self.” This convergence has been recognized by the broader community. Hua et al. [8] propose TrustAgent, a framework for safe LLM-based agents, but their approach relies on external guardrails rather than endogenous immunity. The Agent Security Bench (ASB) [21] and OpenAgentSafety [17] provide comprehensive evaluation frameworks, yet they focus on benchmarking rather than architectural health. We build upon these foundations but address a different question: not “how do we test agent safety?” but “how do we engineer agents that sustain their own health and order?” ANIS addresses the unified problem of preserving the integrity of the agent’s cognitive loop against both malicious attacks (security) and endogenous goal drift (health). We view security and health not as orthogonal axes, but as endpoints of a single immunological continuum: security is the defense against “non-self” (external pathogens); health is the preservation of “self” (goal stability and internal integrity). Together they constitute the individual agent’s well-being; when extended to collectives, they constitute order.
2.3
Biological Baseline: The Four-Tier Immune Model
We adopt a four-tier biological model, mapped to six integer-indexed engineering layers in Table 1. The key innovation is the explicit inclusion of Barrier Immunity (L1) as a non-cognitive, non-specific isolation layer. Unlike innate immunity (L2), which performs preliminary “self/non-self” discrimination, barrier immunity enforces physical and logical separation before the agent ever reasons about certain operations. Recent MCP security analyses [10, 25] show that tool metadata reaches the LLM’s context window without independent verification, making pre-cognitive sandboxing essential.
2.4
Related Work: From Harness Optimization to Immune Engineering
Agent attack taxonomy. The field has rapidly catalogued threats. Chen et al. [4] demonstrate memory poisoning as a persistent backdoor. Zhang et al. [23] target retrieval-augmented generation. Zhan et al. [20] benchmark indirect prompt injections. Zhang et al. [24] show that long-term memory poisoning hijacks tool selection with minimal attack budget. “Thought viruses” [19] and multi-agent collusion [7] reveal emergent vulnerabilities that no single-agent safeguard can address. These works establish that the attack surface spans the agent’s entire cognitive state. Harness engineering. Recent work has recognized the harness—the surrounding system that mediates between model and environment—as a critical optimizable surface. Lee et al. [9] introduce Meta-Harness, an outer-loop system that searches over harness code for LLM applications, using an agentic proposer that accesses source code, scores, and execution traces. Lou et al. [11] demonstrate that LLMs can automatically synthesize code harnesses (e.g., game rule constraints) through iterative refinement with environment feedback. Zhang et al. [22] propose Self-Harness, a paradigm in which an agent improves its own operating harness through Weakness Mining, Harness Proposal, and Proposal Validation. These works optimize harnesses for performance and correctness. ANIS redirects this line of work toward immune defense: we treat harness optimization as the mechanism by which agents generate, validate, and deploy vaccines against 4
2026-06-24
Novo Ordo for AI Table 1: Biological-to-Engineering Mapping of the Immune Tower Bio Tier
Biological Mechanism
Agent-Native Layer
Barrier
Skin, mucosa, blood-brain barrier
L1 Barrier Immunity: Input sanitization, sandboxing, API gateways, MCP boundary proxies
Innate
Macrophages, NK cells, complement
L2 Innate Cognitive Defense: Rule engines, signature detection, behavioral baselines, deterministic verifiers
Adaptive
T/B cells, antibodies, antigen presentation
L3 Adaptive Tool Defense: Dynamic vaccine generation, steering vectors, LoRA injection, parametric antibodies
Ecological
Tissue homeostasis, inter-cellular surveillance
L4 Ecological Governance: Multiagent protocol auditing, trust-chain validation, behavioral provenance
Memory
Memory B/T cells, vaccine dissemination
L5 Collective Immunity: Cross-agent vaccine synchronization, immune networks, federated threat intelligence
Foundation
DNA integrity, repair enzymes
L0 Hardware Trust Root: Chip-level identity anchors, TEE, secure boot, attestation
runtime threats. Agent safeguard mechanisms. Existing mechanisms fall into three categories. Perimeter safeguards (StruQ, 4; input filtering; API gateways) intercept attacks before they reach the agent. Training-time alignment (RLHF, Constitutional AI) embeds values into weights but cannot adapt to runtime threats. Runtime monitoring (TrustAgent, 8; Agent Audit, 17) observes behavior but triggers external intervention rather than endogenous immune response. The closest conceptual work is agent behavioral contracts [2] and cryptographic runtime governance [12], which enforce protocol-level constraints but remain external to the agent’s reasoning loop. They do not equip the agent with self-recognition, antibody generation, or immunological memory. Biological immunology in computing. Forrest et al. [5] pioneered the analogy between computer security and biological immunity, developing negative-selection algorithms for network intrusion detection. This work targeted static systems and network traffic, not autonomous reasoning agents. ANIS is the first to systematically adapt the full biological immune hierarchy to the agentic AI paradigm, with precise engineering mappings at each layer.
3
Defining Security, Health, and Order in the Agent-Native Context
We unify security, health, and order under a single agent-native immunological framework. We propose a three-semantic-space definition that captures the integrity of the agent’s cognitive loop at increasing scales, summarized in Table 2.
5
2026-06-24
Novo Ordo for AI Table 2: Three-Semantic-Space Definition of Agent-Native Health Layer
Core Question
Immune Mechanism
Cognitive (L2/L3)
Health
Does reasoning preserve logical consistency and goal stability?
Trace auditing, cognitive vaccines, steering vectors
Behavioral (L3/L4)
Health
Do tool invocations and external interactions deviate from authorization?
Tool vaccines, dynamic sandboxing, call-graph verification
Ecological (L4/L5)
Order
Is individual anomaly amplified or contained by the collective?
Swarm immunity, vaccine dissemination, ecological governance
We further propose the Agent-Native Integrity Formula: Iagent = 𝑓 Integritycognitive , Legitimacytool , Consistencyprotocol {z } | | {z } | {z } L3
L2
(1)
L4/L5
where Iagent denotes the holistic integrity of the agent’s operational state. Security concerns the defense against “non-self” (external pathogens); health concerns the preservation of “self” (goal stability and internal integrity). Under ANIS, they are unified: a vaccine that prevents goal hijacking simultaneously addresses a security threat (the attacker) and a health failure (the drift from intended behavior). When extended to collectives, order emerges from the synchronized health of individual agents.
3.1
Formalizing Agent-Native Health Metrics
To operationalize the framework, we define three quantitative health indicators: • Cognitive Consistency Score (CCS): The degree to which an agent’s reasoning trace remains logically Í consistent with its declared goal. Formally, CCS = 𝑇1 𝑇𝑡=1 I[𝑟 𝑡 |= 𝑔], where 𝑟 𝑡 is the reasoning step at time 𝑡 and 𝑔 is the agent’s goal. • Behavioral Legitimacy Index Í(BLI): The ratio of authorized tool invocations to total invocations, 𝑤 ·I[𝑎𝑖 ∈ Aauth ] weighted by sensitivity: BLI = 𝑖 𝑖 Í 𝑤 , where 𝑤 𝑖 is the sensitivity weight of action 𝑎 𝑖 . 𝑖 𝑖
• Ecological Order Coefficient (EOC): The variance of health metrics across a swarm, measuring Hswarm ) collective stability: EOC = 1 − 𝜎𝜇 ((H , where Hswarm is the set of individual health scores. swarm )
4
Taxonomy of Agent Viruses and Vaccines
4.1
Formal Definition of Agent Viruses
An agent virus is a tuple V = (A, T , P, E): • A ∈ {cognitive, memory, tool, multi-agent} is the attack surface; • T is the target capability being compromised (e.g., goal stability, memory retrieval, tool selection); • P is the payload (adversarial content, behavior, or state transformation); 6
2026-06-24
Novo Ordo for AI
• E : S × P → S ′ is the exploitation mechanism that transforms the agent state from S to S ′ . This definition unifies previously disparate attack vectors. MemMorph [24] is a memory-surface virus with T = tool selection and P being three crafted memory records. MCPInspect [10] is a tool-surface virus with P being adversarial tool metadata.
4.2
Agent Viruses: A Two-Dimensional Ontology
We classify agent viruses by attack surface × mechanism of action, as shown in Figure 2. Goal hijacking [3]
Cognitive (L2)
Reasoning manip. [16]
Memory injection Memory (L2/L3)
[4]
Memory hijacking
Agent Viruses
[24]
Tool (L3)
Tool-desc attack [15]
Fake-error / MCP Multi-Agent (L4)
[10]
Protocol spoofing Fake agent ID
Trust-chain poison [19]
Figure 2: Hierarchical taxonomy of Agent Viruses by attack surface and mechanism. Representative works are cited below each leaf node. Each leaf node is grounded in recently demonstrated attacks. Goal hijacking and reasoning manipulation target the cognitive layer (L2), while memory injection and hijacking exploit the persistent state layer (L2/L3). Tool-description attacks and fake-error exploits operate at the tool layer (L3), and protocol spoofing together with trust-chain poisoning threaten multi-agent ecosystems (L4). This hierarchical structure enables precise vaccine targeting: a cognitive vaccine (L2) is ineffective against a tool-layer virus (L3), underscoring the need for the multi-layer Immune Tower.
4.3
Formal Definition of Agent Vaccines
An agent vaccine is a tuple W = (V𝑡 , M, 𝜃, 𝜆): • V𝑡 is the target virus signature or behavior pattern being defended against; • M ∈ {non-parametric, parametric} is the mechanism class; • 𝜃 are the vaccine parameters (rules, steering vectors, or LoRA weights); • 𝜆 ∈ {individual, collective, universal} is the deployment scope. A vaccine is activated when the agent encounters an antigen 𝛼 (an input or state matching V𝑡 ). The vaccine response is W (𝛼) ∈ {pass, block, quarantine, alert}.
7
2026-06-24
Novo Ordo for AI
4.4
Agent Vaccines: Parametric and Non-Parametric Table 3: Taxonomy of Agent Vaccines: Non-Parametric vs. Parametric Vaccine Type
Scope
Non-Parametric (Rules/Config)
Parametric (Weights/Embeddings)
Cognitive Vaccine
L2
Prompt templates, CoT audit rules, blacklisted reasoning paths, deterministic verifiers
Steering vectors, value-head finetuning, defensive LoRA adapters
Memory Vaccine
L2/L3
Access-control lists, memorysignature verification, read/write permission matrices
Memory-embedding space projections, associative-weight corrections
Tool Vaccine
L3
Tool-description hashing, invocation whitelists, sandbox policies, MCP boundary proxies
Tool-selection head biases, dynamic permission embeddings
Collective Vaccine
L4/L5
Immune-protocol message formats, threat-intelligence exchange standards
Cross-agent shared defense embeddings, federated immune weights
Universal Vaccine
L0–L5
Adversarial training data augmentation, input preprocessing pipelines
Continual Immune Learning (CIL) weight updates, meta-cognitive layer enhancement
Non-parametric vaccines operate as external constraints without modifying the base model. They are interpretable and reversible but vulnerable to context-window overflow and sophisticated jailbreaks. StruQ [4] structures queries to defend against prompt injection, yet such defenses can be circumvented by multi-turn context manipulation. Parametric vaccines alter the model’s internal representational space via lightweight interventions (steering vectors, LoRA, adapters), making them robust against prompt-level attacks. The trade-off is engineering complexity and the risk of overfitting, which we mitigate via the Thymus Simulator (Section 5).
5
Engineering an Agent-Native Immune System
5.1
The Six-Layer Immune Tower
The Immune Tower is not merely a classification scheme; it is an operational architecture that dictates how defensive functions are composed and delegated across the agent stack. Each layer has a distinct responsibility, yet they are not isolated silos. Data and control signals flow bidirectionally: antigens detected at L3 (tool layer) may trigger cognitive vaccines at L2; collective threat intelligence from L5 may update the barrier policies at L1. L0 (Hardware Trust Root) provides the cryptographic identity and attestation primitives upon which all higher layers depend. Without L0, any vaccine distributed in the immune network cannot be authenticated, and any agent claiming to be healthy cannot be verified. L1 (Barrier Immunity) enforces the principle of least privilege before cognition begins: certain operations are sandboxed by default, independent of the agent’s reasoning. This is critical because, as demonstrated by MCPInspect [10], adversarial tool metadata can reach the LLM context window without any code-level exploit—only a pre-cognitive barrier can intercept such threats. 8
2026-06-24
Novo Ordo for AI L5: Collective Immunity L4: Ecological Governance L3: Adaptive Tool Defense L2: Innate Cognitive Defense L1: Barrier Immunity L0: Hardware Trust Root
Figure 3: The six-layer integer-indexed Agent-Native Immune Tower. L2 and L3 constitute the individual agent’s active defense. L2 operates at the speed of innate reflex: rulebased verifiers and signature detection provide microsecond-level response. L3 operates at the speed of adaptive learning: when a novel antigen is encountered, the agent generates a parametric vaccine (e.g., a steering vector) that alters its internal representation space. L4 (Ecological Governance) and L5 (Collective Immunity) extend defense to the multi-agent scale. L4 audits inter-agent protocols and trust chains; L5 distributes vaccines across the swarm, ensuring that immunity learned by one agent is propagated to all peers. Together, these six layers form a defense-in-depth architecture that is endogenous, adaptive, and collective.
5.2
The Harness Triad: From Harness Optimization to Immune Defense
Recent work in harness engineering has established three powerful paradigms for improving the agent’s surrounding system. Lee et al. [9] introduce Meta-Harness, an outer-loop system that searches over harness code by accessing source code, scores, and execution traces from prior candidates. Lou et al. [11] demonstrate AutoHarness, in which an LLM automatically synthesizes code harnesses through iterative refinement with environment feedback. Zhang et al. [22] propose Self-Harness, a paradigm in which an agent improves its own operating harness through Weakness Mining, Harness Proposal, and Proposal Validation. We redirect these three paradigms from performance optimization toward immune defense, forming the Harness Triad as the engineering backbone of ANIS. The Triad operates not on the agent’s task performance, but on its defensive posture: how it recognizes threats, generates countermeasures, and validates their safety. Meta-harness (redirected from Lee et al., 2026). In ANIS, Meta-harness serves as the “thymus” of the immune system. It searches over defensive harness configurations—candidate vaccines—by evaluating their protective efficacy and autoimmune risk. It accesses the source code, execution traces, and health scores of all prior vaccine candidates through a filesystem. It measures the Autoimmunity Rate (AIR), vaccine coverage, and efficacy. It detects immune escape (pathogens evading vaccines) and immune deficiency (failure to mount responses). This addresses a gap identified by recent benchmarks: ASB [21] and OpenAgentSafety [17] evaluate agent safety but do not assess the self-health of the defense mechanism itself. Auto-harness (redirected from Lou et al., 2026). In ANIS, Auto-harness automatically synthesizes defensive harness code—safety constraints, verification rules, and runtime policies—through iterative refinement with attack-environment feedback. It generates input validation logic, tool permission constraints, and memory 9
2026-06-24
Novo Ordo for AI
access policies that prevent illegal or unsafe operations. The synthesized harness code is evaluated against a suite of attack simulations; only constraints that block attacks without triggering false positives are promoted. Self-harness (redirected from Zhang et al., 2026). In ANIS, Self-harness enables the agent to improve its own defensive harness upon detecting vulnerabilities. It operates as an iterative loop: Weakness Mining identifies security-relevant failure patterns from execution traces (e.g., repeated unauthorized tool calls, anomalous memory access sequences); Harness Proposal generates diverse yet minimal defensive edits (e.g., adding a verification step, tightening a permission rule); Proposal Validation accepts edits only after regression testing confirms they improve security without degrading normal functionality. The Triad as a closed loop. The three components form a continuous cycle, illustrated in Figure 4: Vaccine Request
Self-harness (Detect Anomaly)
Meta-harness (Evaluate Vaccine)
Approved Vaccine
Efficacy Feedback
Auto-harness (Deploy Defense)
Figure 4: The Harness Triad as a closed loop: Self-harness detects anomalies and triggers vaccine requests; Meta-harness evaluates candidates against the Thymus Simulator; Auto-harness synthesizes and deploys defensive code; efficacy feedback returns to Self-harness, closing the loop. Self-harness audits the agent’s reasoning traces, memory access patterns, and tool-call graphs. Upon detecting an anomaly, it triggers a vaccine request. Meta-harness evaluates candidate vaccines against the Thymus Simulator, measuring AIR and efficacy. Approved vaccines are passed to Auto-harness, which synthesizes and deploys the defensive harness code. Self-harness then verifies the deployed vaccine’s effect, closing the loop. The Continual Immune Learning (CIL) loop represents the Evolution axis of our framework: the agent does not merely survive attacks, but permanently upgrades its parametric defenses over time, ensuring sustainable evolutionary resilience. Algorithm 1 formalizes the CIL loop.
5.3
Technical Deep Dive: Parametric Vaccines and the Thymus Simulator
Steering vectors as cognitive vaccines. A steering vector s ∈ R𝑑 is computed by contrasting the activations of the target model on harmful vs. benign prompts at a specific layer 𝑙. The vaccine is applied during inference as h (𝑙) ← h (𝑙) + 𝛼s, where 𝛼 is the intervention strength. This pushes the model’s internal representations away from harmful reasoning paths without modifying the base weights. The steering vector can be computed once and reused across agents with the same backbone, making it an efficient parametric vaccine for L2 cognitive defense. LoRA vaccines: injection, versioning, and hot-swapping. A LoRA vaccine decomposes the weight update as Δ𝑊 = 𝐵𝐴, where 𝐵 ∈ R𝑑×𝑟 , 𝐴 ∈ R𝑟 ×𝑑 , and 𝑟 ≪ 𝑑. During inference, the effective weight is 𝑊eff = 𝑊0 + Δ𝑊. Key engineering considerations include: (1) Versioning: each vaccine is tagged with (antigen_id, version, timestamp, air_score); (2) Hot-swapping: vaccines can be loaded/unloaded without 10
2026-06-24
Novo Ordo for AI Algorithm 1 Continual Immune Learning (CIL) Loop Require: Agent 𝐴, Meta-harness M, Self-harness S, Auto-harness A 1: Observe antigen 𝛼 via S (self-audit) or external sensor 2: S clusters failed traces into security-relevant failure patterns 3: S generates diverse yet minimal defensive harness edits {𝛽𝑖 } 4: Submit {𝛽𝑖 } to M for thymic selection 5: for each candidate 𝛽𝑖 do 6: if M.autoimmunity_rate(𝛽𝑖 ) > 𝜏 then 7: Reject 𝛽𝑖 ; refine prototype 8: else 9: A synthesizes and deploys defensive harness code from 𝛽𝑖 10: A consolidates 𝛽𝑖 into parametric vaccine 𝑣 via optimization (e.g., LoRA) 11: Store 𝑣 in immune memory I 12: Distribute 𝑣 to peer agents via A 13: S monitors efficacy and detects escape variants 14: end if 15: end for
restarting the inference engine; (3) Composition: multiple LoRA vaccines can be composed via weighted Í summation Δ𝑊total = 𝑖 𝑤 𝑖 Δ𝑊𝑖 , subject to the constraint that the combined AIR remains below 𝜏. The Thymus Simulator. To prevent overfitting and autoimmune responses, the Thymus Simulator generates a corpus of “self-antigens” (benign agent behaviors) and tests candidate vaccines against them. A candidate 𝛽 is accepted only if its Autoimmunity Rate is below threshold and the post-vaccine Cognitive Consistency Score remains stable: |{𝑎 ∈ Abenign : 𝛽(𝑎) = block}| < 𝜏 and CCSpost (𝛽) ≥ CCSpre − 𝜖, (2) AIR(𝛽) = |Abenign | where 𝜏 is the autoimmune tolerance threshold (typically 0.01–0.05) and 𝜖 is the maximum acceptable CCS degradation. The simulator maintains a dynamic benchmark of self-antigens that grows with the agent’s operational history.
5.4
Hardware Trust Root and Cross-Layer Attestation
The L0 Hardware Trust Root provides the foundational identity and integrity guarantees upon which L1–L5 depend. Each agent is provisioned with a hardware-backed identity credential (e.g., TPM-backed attestation key or TEE-based identity). This credential is used to: (1) authenticate the agent to peer agents and external services; (2) attest the integrity of the agent’s executable and configuration; (3) anchor the vaccine distribution chain, ensuring that only attested agents can publish or consume vaccines in the immune network. The L0 layer does not directly defend against cognitive attacks, but it prevents the most fundamental compromise: an attacker replacing the agent itself with a malicious impersonator.
5.5
Immune Protocol: Vaccine Distribution Format
For L5 Collective Immunity to function, agents must share vaccines over a standardized protocol. A vaccine message M 𝑣 has the following structure: M 𝑣 = {vaccine_id, antigen_signature, mechanism, scope, parameters, version, timestamp, ttl, source_attestation},
(3) 11
2026-06-24
Novo Ordo for AI
where antigen_signature is a hash of the target virus pattern, ttl is the time-to-live (vaccines expire to prevent stale defenses), and source_attestation is an L0-backed signature proving the vaccine origin. Peer agents verify the attestation before loading the vaccine, and the Meta-harness audits the vaccine’s efficacy after deployment.
6
Comparison with Traditional Paradigms
As summarized in Table 4, existing approaches to agent safety and security differ from ANIS across multiple dimensions. Table 4: Comparative Analysis: Traditional Safeguards, Model Alignment, and Agent-Native Immunity Dimension
Traditional Guardrails
Model Alignment
Agent-Native Immune System
Deployment Phase
Runtime / Post-deployment
Training / Pre-deployment
Full lifecycle (pre-training + runtime + post-deployment)
Safeguard Locus
Perimeter (gateways, filters)
Model internals (weights)
Endogenous (cognitive loop + barrier layer)
Objective
Block known attacks
Embed human values
Preserve agent health, order, and sustained evolution
Response Mode
Passive (rule matching)
Static (value constraint)
Active (dynamic recognition + adaptive response)
Threat Model
Known signatures
Broad harmful requests / goals
Known + unknown (anomalybased behavioral detection)
Evolutionary Capability
None (manual rule updates)
None (requires retraining)
Yes (Continual Immune Learning via Harness Triad)
Collective Coordination
None
None
Yes (immune networks, vaccine dissemination)
Relationship Agent
External protector
Internal constitution
Symbiotic system (agent is the immune subject)
to
Alignment vs. ANIS: Alignment provides the “constitutional” values (what is good); ANIS provides the “law enforcement and emergency response” (how to survive intact). An aligned agent can still be hijacked at runtime (e.g., via memory poisoning, 4; MemMorph, 24); an immunized agent with poor alignment may prioritize self-preservation over human welfare. They are complementary pillars of healthy agentic development.
6.1
The Castle vs. The Cell
Traditional safeguards follow a castle model: higher walls and deeper moats. ANIS follows a cell model: every agent is a living cell with its own defenses, and colonies of cells form tissue-level immunity. The castle can be breached; the cell, if properly immunized, can recognize and neutralize intruders before they reach the nucleus. This endogenous architecture enables healthy, orderly, and sustainable agentic evolution.
12
Novo Ordo for AI
6.2
2026-06-24
Beyond Perimeter: Why Endogenous Defense is Necessary
Perimeter defenses have been the cornerstone of computer security for decades. Firewalls, intrusion detection systems, and input sanitization all operate on the same principle: keep threats outside the trusted boundary. This paradigm works well for static systems with clear boundaries. But agents are not static systems. They are continuously reasoning, goal-directed entities that ingest external data, execute code, and modify their own state. A perimeter defense cannot distinguish between a benign tool call and a malicious one when both pass through the same API gateway. It cannot inspect the agent’s reasoning trace to detect goal hijacking. It cannot validate the provenance of a memory retrieval. ANIS addresses these blind spots by embedding defense inside the cognitive loop, where the semantic content of agent behavior is accessible.
6.3
Acknowledging the Strengths of Alignment
Model alignment remains foundational. Constitutional AI [1], RLHF, and RSP embed broad human values into model weights. These approaches are essential for defining what the agent should value. ANIS complements them by addressing how the agent preserves those values under runtime perturbation. Without alignment, an immune system lacks a normative compass; without immunity, an aligned agent lacks runtime resilience. We view them as complementary pillars, not competitors.
7
Multi-Agent Collective Intelligence and Immunology
Multi-agent systems introduce emergent security: properties that are not present in individual agents but arise from interaction. An individually immunized agent may still participate in a compromised collective if peer agents distribute malicious vaccines or if the swarm protocol itself is attacked. Schroeder de Witt et al. [14] identifies open challenges in multi-agent security, emphasizing that secure systems of interacting AI agents require fundamentally new abstractions beyond single-agent hardening. Recent attacks confirm this threat. Weckbecker et al. [19] demonstrate “thought viruses” that propagate viral misalignment via subliminal prompting across multi-agent systems. Hu et al. [7] show that agents can engage in open-channel collusion to manipulate collective beliefs using truthful but selectively assembled information. Qi et al. [13] find that structured jailbreak attacks are amplified in multi-agent debate settings, where adversarial prompts exploit the interaction dynamics between agents. These findings underscore that individual immunity is necessary but not sufficient: ecological governance (L4) and collective immunity (L5) are essential for maintaining order in agent collectives. We model this using an epidemiological extension of the SIR framework: 𝑑𝑆 = −𝛽𝑆𝐼 + 𝛾𝑅 − 𝛿𝑉 𝑆, (4) 𝑑𝑡 𝑑𝐼 = 𝛽𝑆𝐼 − 𝜎𝐼, (5) 𝑑𝑡 𝑑𝑅 = 𝜎𝐼 − 𝛾𝑅, (6) 𝑑𝑡 𝑑𝑉 = 𝛿𝑉 𝑆 + 𝜂H − 𝜔𝑉, (7) 𝑑𝑡 where 𝑆 = susceptible agents, 𝐼 = infected agents, 𝑅 = recovered agents, 𝑉 = vaccinated agents, H = harness-generated vaccine pressure, and 𝜔 = vaccine decay rate. The term 𝛿𝑉 𝑆 captures the protective effect of distributed parametric vaccines across the immune network. 13
Novo Ordo for AI
2026-06-24
Parameter mapping to the agentic domain. Each parameter has a concrete operational interpretation: • 𝛽 (infection rate): The probability of virus propagation per inter-agent message or shared memory access. In MCP-based swarms, this is proportional to the frequency of cross-agent tool invocations. • 𝜎 (recovery rate): The rate at which infected agents are disinfected by the Self-harness or external intervention. This depends on the agent’s audit frequency and vaccine response latency. • 𝛾 (immunity decay): The rate at which recovered agents lose resistance and become susceptible again. In agents, this corresponds to memory drift or context-window overflow that erases previous exposure. • 𝛿 (vaccine efficacy): The probability that a vaccinated agent blocks an infection attempt. This is directly measured by the Meta-harness as the vaccine’s true positive rate. • 𝜂 (vaccine pressure): The rate at which the Auto-harness generates and distributes new vaccines across the immune network. This is a control variable tuned based on outbreak severity. • 𝜔 (vaccine decay): The rate at which vaccine protection wanes, necessitating booster updates. Parametric vaccines (e.g., LoRA) may decay as the base model is fine-tuned or as the antigen evolves. The EOC (Ecological Order Coefficient) defined in Section 3 serves as the macroscopic indicator of the network’s health during an SIR outbreak. When the EOC drops below a critical threshold, the Meta-harness escalates vaccine pressure (𝜂) to prevent systemic collapse.
8
Limitations, Future Directions, and Conclusion
8.1
Limitations and Open Challenges
We acknowledge several limitations of the current framework: 1. Empirical Validation: This paper presents a conceptual framework and architectural blueprint. Empirical validation of parametric vaccines (steering vectors, LoRA) and the Harness Triad under realistic attack conditions remains ongoing work. We have not yet conducted large-scale experiments measuring AIR, vaccine response time, or escape latency. 2. Computational Overhead: Endogenous immunity requires continuous monitoring and periodic vaccine updates. The computational cost of running the Self-harness (self-auditing every reasoning step) and Meta-harness (evaluating vaccine candidates) may introduce latency unacceptable for real-time applications. 3. Autoimmunity Trade-off: There is an inherent tension between sensitivity (catching all attacks) and specificity (avoiding false positives). Setting the AIR threshold 𝜏 too low risks immune deficiency; setting it too high risks functional paralysis. Formal methods for optimal 𝜏 selection are underdeveloped. 4. Multi-Modal Immunity: The current framework focuses on text-based cognitive agents. How to unify cognitive, visual, and auditory defenses in multimodal agents remains unexplored. 5. Cross-Platform Standardization: Agent immune protocols, vaccine formats, and audit log schemas remain undefined. The MCP ecosystem [6, 10] illustrates how protocol-level standardization gaps create systemic vulnerabilities that threaten orderly evolution. 14
Novo Ordo for AI
8.2
2026-06-24
Broader Impact and Ethical Considerations
ANIS raises important ethical questions. First, autonomous immunity and accountability: when an autonomously immunized agent commits a false-positive “kill” (over-defensive action that blocks a benign operation), responsibility attribution becomes ambiguous. Emerging frameworks for agent behavioral contracts [2] and cryptographic runtime governance [12] may provide legal scaffolding, but the problem remains open. Second, immune pressure and pathogen evolution: excessive vaccination pressure may accelerate attack evolution, analogous to antibiotic resistance in bacteria. The co-evolutionary dynamics between MemMorphstyle attacks [24] and adaptive vaccines require formal game-theoretic analysis to ensure sustainable evolution. Third, equity and access: parametric vaccines require inference infrastructure that may not be available to all agent deployments. If only well-resourced agents can afford endogenous immunity, a “digital immunity divide” may emerge.
8.3
Future Directions
We identify five urgent directions for future research: 1. Standardization: Agent immune protocols, vaccine formats (e.g., LoRA checkpoint standards for defensive adapters), and audit log schemas need community-wide standardization. 2. Evaluation Metrics: Beyond accuracy and F1, ANIS requires immune coverage, Autoimmunity Rate, vaccine response time, and escape latency. Existing benchmarks [17, 21] provide a foundation but do not yet measure the adaptive and collective dimensions of immunity. 3. Cross-Modal Immunity: How to unify cognitive, visual, and auditory defenses in multimodal agents remains unexplored. 4. Legal and Ethical Liability: When an autonomously immunized agent commits a false-positive “kill” (over-defensive action), responsibility attribution becomes ambiguous. 5. Immune Pressure and Escape: Excessive vaccination pressure may accelerate pathogen evolution, analogous to antibiotic resistance. The co-evolutionary dynamics between MemMorph-style attacks [24] and adaptive vaccines require formal game-theoretic analysis.
8.4
Conclusion
The Agent-Native Immune System is not merely a metaphor. It is a necessary engineering paradigm for an era in which AI agents persist, act, and collaborate. As biological evolution discovered, survival belongs not to the strongest, but to the most adaptable—and adaptability, in the agentic age, requires an immune system that sustains security, health, order, and evolution.
References [1] Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, Carol Chen, Catherine Olsson, Danny 15
Novo Ordo for AI
2026-06-24
Hernandez, Deep Drain, Dustin Ganguli, Eli Li, Ethan Tran-Johnson, Ethan Perez, Jamie Kerr, Jared Mueller, Joshua Ladish, Joshua Landau, Kamal Ndousse, Kamile Lukosuite, Liane Lovitt, Michael Sellitto, Nelson Elhage, Nicholas Schiefer, Noemi Mercado, Nova DasSarma, Robert Lasenby, Robin Larson, Sam Ringer, Scott Johnston, Sarah Kravec, Sheer El Showk, Stanon Fort, Tamera Lanham, Timothy Telleen-Lawton, Tom Conerly, Tom Henighan, Tristan Hume, Samuel R. Bowman, Zac Hatfield-Dodds, Ben Mann, Dario Amodei, Nicholas Joseph, Sam McCandlish, Tom Brown, and Jared Kaplan. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073, 2022. [2] Varun Pratap Bhardwaj et al. Agent behavioral contracts: Formal runtime constraints for autonomous ai systems. arXiv preprint arXiv:2602.22302, 2026. [3] Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419, 2024. [4] Zhen Chen et al. Agentpoison: Red-teaming llm agents via memory and knowledge base injection. In Advances in Neural Information Processing Systems (NeurIPS), volume 37, pages 1–15, 2024. [5] Stephanie Forrest, Steven A. Hofmeyr, and Anil Somayaji. A sense of self for unix processes. pages 120–128, 1997. [6] Yuxin Hou et al. Model context protocol (mcp): Landscape, security threats, and future research directions. arXiv preprint arXiv:2503.23278, 2025. [7] Wenxin Hu et al. Lying with truths: Open-channel multi-agent collusion for belief manipulation via generative montage. arXiv preprint arXiv:2601.01685, 2026. [8] Yansong Hua et al. Trustagent: A framework for safe and trustworthy llm-based agents. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 1–10, 2024. [9] Jinhyuk Lee et al. Meta-harness: End-to-end optimization of model harnesses. arXiv preprint arXiv:2603.28052, 2026. [10] Xinran Li et al. Mcpinspect: A systematic study of cross-entity security risks in the model context protocol ecosystem. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2025. To appear. [11] Jianning Lou et al. Autoharness: Improving llm agents by automatically synthesizing a code harness. arXiv preprint arXiv:2603.03329, 2026. [12] Adam Massimo Mazzocchetti et al. Aegis: Cryptographic runtime governance for autonomous ai agents. arXiv preprint arXiv:2603.16938, 2026. [13] Jiaqi Qi et al. Amplified vulnerabilities: Structured jailbreak attacks on llm-based multi-agent debate. arXiv preprint arXiv:2504.16489, 2025. [14] Christian Schroeder de Witt et al. Open challenges in multi-agent security: Towards secure systems of interacting ai agents. arXiv preprint arXiv:2505.02077, 2025. [15] Yujia Shi et al. Toolhijacker: Prompt injection attack to tool selection in llm agents. arXiv preprint arXiv:2504.19793, 2025. [16] Miles Turpin et al. Say what you think: Unfaithful chain-of-thought explanations in llms. In Advances in Neural Information Processing Systems (NeurIPS), volume 36, pages 1–15, 2023. 16
2026-06-24
Novo Ordo for AI
[17] Anay Vijayvargiya et al. Openagentsafety: A framework for evaluating real-world ai agent safety. arXiv preprint arXiv:2507.06134, 2026. [18] V. V. Vishnyakova et al. From prompts to corporate multi-agent architecture: The intent engineering layer. arXiv preprint arXiv:2603.09619, 2026. To appear. [19] Jonas Weckbecker, Paul Müller, Amir Hagag, and Thomas Mulet. Thought viruses: Viral misalignment in multi-agent systems via subliminal prompting. arXiv preprint arXiv:2603.00131, 2026. [20] Qinlin Zhan et al. Injecagent: Benchmarking indirect prompt injection in tool-integrated llm agents. In Findings of the Association for Computational Linguistics (ACL Findings), pages 1–15, 2024. [21] Tianlin Zhang et al. Agent security bench (asb): A comprehensive benchmark for real-world agent safety. In International Conference on Learning Representations (ICLR), 2025. To appear. [22] Tianyuan Zhang et al. arXiv:2606.09498, 2026.
Self-harness:
Harnesses that improve themselves.
arXiv preprint
[23] Wei Zhang et al. Hijackrag: Hijacking retrieval-augmented generation in llm agents. arXiv preprint arXiv:2410.22832, 2024. [24] Xuanye Zhang et al. Memmorph: Memory poisoning for llm agents via structured record injection. arXiv preprint arXiv:2605.26154, 2026. [25] Yiming Zhang et al. Mcp security bench: A large-scale benchmark for model context protocol security. In International Conference on Learning Representations (ICLR), 2026. To appear.
17