32%
rise in malicious hidden-instruction content on the web between November 2025 and February 2026, across the billions of pages Google crawls each month.
Cloud Security Alliance, April 2026An AI agent obeys whatever reaches it: an email, a web page, a document, a tool result, another agent. DOR proves where every instruction came from, and holds anything that cannot show it, before the agent acts.
This is already happening.
In 2025 and 2026, attackers stopped breaking into AI systems and started talking to them. A hidden line in an email, a calendar invite, or a log file was enough to make an assistant hand over data or act on an order no one gave.
700+
organizations affected after attackers stole the access tokens an AI chat agent used to connect to customer systems, then used them to pull data.
TechTarget, September 20259.3 of 10
severity rating of EchoLeak, a flaw that let one email carrying hidden instructions make an AI assistant leak internal data without anyone clicking anything.
The Hacker News, June 2025Feb 23, 2026
the day an AI agent asked only to suggest emails to clean up was reported deleting a user's inbox and ignoring commands to stop.
OWASP GenAI Security Project, April 2026Apr 3, 2026
the day a breach at an AI data company was reported after tampered versions of a widely used open-source AI tool were published. A major customer paused its work with the vendor.
OWASP GenAI Security Project, April 2026Apr 7, 2026
the day researchers disclosed hidden instructions placed in log data that made an AI assistant send enterprise data to an outside server.
OWASP GenAI Security Project, April 2026Every instruction proven before an agent acts.
Agents read, decide, and act on their own. DOR proves where each instruction, document, and model came from, so authority comes from the source and never from the words.
InstructionsWhat an agent is told, and who is allowed to tell it.Data and KnowledgeThe documents, search results, and data an agent reads and learns from.Tools and ActionsPayments, messages, code, and changes an agent makes in the world.Models and Supply ChainThe model, the tools around it, and the updates that change both.Outputs and AccountabilityWhat an AI produced, from what, and who approved it.
Instructions
What an agent is told, and who is allowed to tell it.
I-01
Hidden instructions
A line of text hidden in an email, a web page, or a calendar invite can read to an agent like an order. DOR gives authority only to instructions that come from a verified person or system, so text an agent reads can never command it.
I-02
Who is asking
An agent cannot see the face behind a request. DOR proves which person or system sent each instruction before the agent treats it as a request to act.
I-03
Agent to agent
When agents hand work to other agents, an order can be invented anywhere along the chain. DOR carries the original sender's proof with every handoff.
Data and Knowledge
The documents, search results, and data an agent reads and learns from.
K-01
Poisoned knowledge
Agents answer from documents and search results, and one planted document can steer every answer after it. DOR proves where each source came from before it enters the agent's context.
K-02
Poisoned training
A few bad examples slipped into training or fine-tuning can change how a model behaves. DOR ties every training contribution to its origin before it is accepted.
K-03
Fake media
A synthetic image, voice, or video can enter an AI pipeline as evidence. DOR checks whether content came from its claimed source and is unaltered, with no original needed for comparison.
Tools and Actions
Payments, messages, code, and changes an agent makes in the world.
A-01
Payments, purchases, and orders
An agent that can approve a purchase or move money can be talked into it. DOR holds any consequential action that cannot trace its authority to a verified person.
A-02
Data leaving the building
A manipulated agent can send internal data out through an email, a link, or an image request. DOR holds outbound actions that trace back to content rather than to a verified instruction.
A-03
Code and system changes
Coding and operations agents can delete, overwrite, or reconfigure live systems. DOR requires verified authority and a recorded reason before changes like these go through.
A-04
Stolen agent access
Agents connect to other systems with keys and tokens, and stolen tokens let attackers act as the agent. DOR verifies the agent itself, beyond the token it presents.
Models and Supply Chain
The model, the tools around it, and the updates that change both.
M-01
Swapped or altered models
A model can be replaced or modified after approval and keep answering as if nothing changed. DOR confirms the model running is the approved one and ties every output to it.
M-02
Tampered tools and updates
AI systems are built from open-source tools that update constantly, and one tampered release can reach thousands of companies at once. DOR verifies each update before it installs.
M-03
Backdoored models
A model can carry a hidden trigger that changes its behavior on cue. DOR binds every model to its full history, so when something fires, the cause can be traced and the model held.
Outputs and Accountability
What an AI produced, from what, and who approved it.
R-01
What the AI did and why
When an AI makes a decision, someone will ask why. DOR ties every output to the inputs, model, and instructions that produced it, in a record no one can edit.
R-02
Labeling what AI made
Labels on AI content can be stripped or forged. DOR makes the origin of an AI output a verified fact instead of a label.
R-03
The rules you answer to
Guidance like OWASP's Top 10 for Agentic Applications and laws like the EU AI Act ask organizations to show what their AI did. DOR produces that record.
How DOR works with you.
Nothing to rip out. No change to the models you rely on. Every deployment starts with your AI as it runs today.
Map the agents
DOR maps what your assistants and agents read, who they take instructions from, and what they are allowed to do.
Build to it
Every deployment is built to your models, your tools, your data, and the rules you answer to.
Deploy on what you run
DOR runs as software alongside the AI systems you already operate, in your environment and fully offline where you need it. Where there is nothing suitable, DOR provides a compact host built for it.
Hand over the evidence
You get a record of what each agent received, what was held, and why. It cannot be edited.
Inside every deployment
- Authority from the source
- An instruction counts only when it comes from a verified person or system, never because of what the words say.
- A hold, not just an alarm
- Actions that cannot show their authority are held, and released only by an authorized person with a recorded reason.
- A record that stands
- What each agent received, did, and was stopped from doing, kept in a record no one can edit.
Questions AI teams ask.
Straight answers to what AI, security, and risk leaders ask first.
Does DOR use AI to catch AI attacks?
No. DOR does not score how suspicious something looks. It proves where an instruction, document, or model came from and whether it was changed.
Does DOR replace our AI guardrails or content filters?
No. Guardrails and filters judge what text looks like. DOR proves where it came from, which gives them firmer ground to work from.
Will DOR slow our agents down?
DOR verifies at the pace of the systems it protects. Every deployment is built and tested against your agents and tools before it goes live.
Do we have to change our models or AI vendors?
No. DOR works alongside the models and platforms you already use and does not change how they work.
Does our data leave our environment?
No. DOR runs where your AI runs, including fully offline, and does not need your data or prompts to leave your environment.
Can a person still override the AI?
Always. DOR never stands between a person with authority and the systems they run, and every override is recorded with its reason.
How does DOR help with AI guidance, laws, and audits?
Guidance like OWASP's Top 10 for Agentic Applications, released in December 2025, and laws like the EU AI Act ask organizations to show what their AI did and why. DOR produces a verifiable record of what each agent received, decided, and did that cannot be edited, which supports audits, incident reviews, and regulators.
Is DOR only for companies that build AI?
No. It is for any organization whose people or systems act on what an AI produces, from a single assistant to a fleet of agents.
What does an engagement with DOR look like?
DOR maps your agents, builds to your models and rules, deploys on what you already run, and hands you the evidence. It starts with a briefing.
Reference
The AI Reference.
The full list behind this page: how AI assistants, agents, and models get fooled, in plain language, with what DOR does about each one.
AI
Start with a briefing.
Bring your list of agents and the tools they can reach, or just the question your security team keeps asking. DOR will show you exactly where it fits.