Runtime security that eavesdrops on agent reasoning

What it does

Adrian is a runtime security gate for AI agents. It inspects tool calls, outputs, and reasoning traces as they happen, maintaining a session-wide model of what the agent is allowed to do. When it spots prompt injection, tool poisoning, or an off-remit action, it blocks or flags the request before it reaches the target. The whole stack can run offline via Docker if you prefer not to phone home.

The interesting bit

Most agent monitoring is glorified API audit logging. Adrian also consumes the agent’s reasoning traces—its chain-of-thought—to judge whether an action makes sense in context. The project cites OpenAI and DeepMind research suggesting this dual approach catches significantly more nuanced attacks than behavior-only monitoring, and packages it into something you can actually deploy behind your own firewall.

Key highlights

• Intercepts malicious or misaligned actions in-flight, before execution.
• Correlates behavior logs with reasoning traces for session-wide context awareness.
• Supports fully offline, self-hosted deployments with a bundled local classifier model.
• Ships with SDKs for Python (LangChain/LangGraph) and TypeScript, plus a native Claude Code plugin.
• Cites research claiming 35% higher detection accuracy and 4× more nuanced attack coverage versus behavior-only monitoring.

Caveats

• Self-hosting requires an NVIDIA GPU and roughly 10 GB of disk for the default Gemma classifier; CPU-only mode is acknowledged to be slow on real workloads.
• Integrations for CrewAI and the Anthropic Agents SDK are on the roadmap, not yet available.
• The Python SDK is tightly centered on LangChain and LangGraph instrumentation.

Verdict

Evaluate it if you need a runtime safety net for production LangChain or OpenAI agents, especially one that works air-gapped. Look elsewhere if you are all-in on CrewAI or Anthropic’s native SDK today, or if your infrastructure lacks the GPU headroom for local classification.