In May of 2025, I wrote about how GenAI security was making the exact same mistakes as early container security: trying to force legacy, perimeter tools onto dynamic workloads. The container world solved this by moving away from heavy host-based agents and proxies in favor of lightweight, out-of-band tooling like Falco that ran right next to the compute. GenAI needs that exact same evolution – moving away from brittle prompt wrappers and WAFs toward a decoupled security layer that doesn't ask the LLM to police itself. Today, we're making that architectural jump with the release of Agent Vardøger, an open-source security sidecar for AI agents on Amazon Bedrock AgentCore.
Named after the Norse spirit double that precedes a person to perform actions in advance, Agent Vardøger sits beside your agent rather than in front of it. This means a slow or broken Agent Vardøger never takes your agent down with it, and your revenue-generating chatbot or mission-critical agent doesn't pick up a new resiliency risk. And instead of solely analyzing and blocking individual prompts in a vacuum, it judges the whole session and ends it when it finds an attack, taking away the context the attacker spent turns carefully building.
If you’ve been following along here, very little of this will come as a surprise. From container sidecar parallels to multi-session attacks, we’ve been laying out this architectural framework in public, one post at a time. What moved it from architecture diagrams to actual code was the engineering and security teams we work with.
When we built the GenR3d LLM Security Analyzer, the goal was to find industry-specific abuse cases before an agent ever reached production, and I still believe that's where the security dollar goes furthest. But conversation after conversation with customers came back to the same question: "Great, and what do we do when it happens live?"
Answering that question well meant facing problems the market hasn't solved.
The first is architectural. Asking the model to police itself fails because an LLM receives its system instructions and its data over essentially the same channel. We talked about this in The Modern Cap'n Crunch Whistle blog. And current real-time AI security tools sit as inline proxies between the user and the model. That might work for a simple Q&A chatbot, but it completely breaks down in critical or agentic systems, turning your security stack into a new resiliency risk.
The second is that the most damaging attacks rarely look like attacks one prompt at a time. Social engineering, staged data exfiltration, and slow extraction of business data build up gradually, across a conversation and often across many conversations. A filter that inspects each prompt in isolation sees nothing but ordinary questions.
What customers needed was protection that understands the whole session, sits outside the model it protects, and never becomes the reason their agent is offline. That's the gap Agent Vardøger is built to close. GenR3d hardens the agent before it ships, and Agent Vardøger watches it in production. We built both because you need both.
Right now, Agent Vardøger focuses on inspecting inputs heading to an agent by attaching to the AgentCore Gateway as an interceptor, deployed from a single CloudFormation template. This deployment mechanism means that by default your prompts stay entirely within your own AWS account.
Currently, Agent Vardøger:
Agent Vardøger is designed to be lightweight, unobtrusive, and built for developers who need to secure their agents without sacrificing speed or utility. <sales> Premium signatures covering social engineering and business-logic abuse are available through private AWS Marketplace offers, and a managed version is available for teams that would rather not run the stack themselves. </sales>
This is the start of the road to outcome-based security, not the destination. Multi-turn and multi-session analysis get us closer, because you can't judge the trajectory of an attack from a single prompt.
Next, Tier 3 will learn to recognize the shape of an attack spread across sessions, like the polite scraper who splits an inventory search into small slices across a botnet so no single conversation looks unusual. We won't need to prove it's one actor. If the sessions together form an attack, it's an attack.
After that, because agents increasingly talk to other agents, we want containment to follow the whole chain. Tracking which agents talk to which, over which sessions, means terminating one malicious session can cut off everything downstream of it. That's the container lesson carried to its conclusion: security beside every workload, with visibility across the whole mesh.
And we aren’t forgetting about response monitoring: evaluating what the agent actually hands back against expected intents, responses, and behaviors. We’ve also talked at length about how the future of AI security lies in analyzing the outcome of the prompt – whether that’s an internal database call, a prompt response, or a physical action in the real world. Response monitoring puts that idea into practice.
Is it finished? No. By Anthropic's "Impossible vs. Tedious" test, a session kill makes an attack tedious rather than impossible. But this is an open problem, and we’d love to hear your suggestions on how to solve it.
Agent Vardøger is open source and available today for agents powered by AWS AgentCore.
The contribution I'd value most is signatures and real-world feedback. Every attack pattern you contribute makes everyone else's agents a little harder to talk into things.
Deploy it, try to break it, and tell us what you find. If you want to talk through how this fits your own agents, or think we've got something wrong, reach out at questions@generativesecurity.ai. We're still early days, but this time we get to start from the sidecar instead of spending years working our way toward it.
About the author
Michael Wasielewski is the founder and lead of Generative Security. With 20+ years of experience in networking, security, cloud, and enterprise architecture Michael brings a unique perspective to new technologies. Working on generative AI security for the past 3 years, Michael connects the dots between the organizational, the technical, and the business impacts of generative AI security. Michael looks forward to spending more time golfing, swimming in the ocean, and skydiving... someday.
