- Published on
New Archestra's OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate
- Authors
- Name
- DeepHorus
Archestra released OpenAPPA, an open-source engine designed to stop exfiltration caused by prompt injection or hallucination. It runs outside an AI agent’s prompt and execution loop. Deterministic policies govern access to tools and data.
Archestra says approval models, including Claude Code auto mode and Codex auto-review, cannot consistently track data across tool calls. Their classifiers can be prompt-injected, and some harnesses hide tool outputs from judges. Even a 99.3% ceiling implies 0.7% breaches across millions of calls.
The team reports a 0% attack success rate on Bench-Corp and AgentThreatBench. Bench-Corp contains 20 multi-step enterprise workflows; comparisons showed 10% for Claude Code’s auto mode and 31% for Microsoft FIDES. The benchmark targets bypass risks faced by simple allowlists and denylists.
OpenAPPA implements Archestra’s Agentic Permissions Policy Algebra through a pluggable engine the underlying model cannot inspect, negotiate with, or bypass. Developers configure sources, audiences, trust levels, authorities, and rules in appa.toml. Audience and trust labels are tracked jointly and can only become more restrictive.
Tool contracts define audience and trust requirements, restrictions from returned data, and effects recording successful actions. A CRM ticket read narrows access to internal, allowing process_internal_data only then; publish_update requires public access. Reading a web page lowers trust to suspicious and blocks apply_db_migration, which requires trusted data.
The design addresses a tradeoff between security and utility: overly strict rules can block valid tasks, while loose rules can expose data. Monotonic labels and explicit contracts seek predictable enforcement across multi-step work. Contracts also preserve an audit trail after permitted actions.
Archestra presented the framework in a paper by Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov, Ildar Iskhakov, and Matvey Kukuy. OpenAPPA is positioned as a deterministic alternative to probabilistic approvals. Its value will depend on testing across varied enterprise workflows while preserving task completion.
