Why fail-closed wins
“Fail-closed” means: when a system is unsure, it refuses - instead of letting things through when in doubt. For autonomous AI agents, that's the difference between a thwarted and a successful attack.
Fail-open vs. fail-closed
Every protection system has to decide what to do when it's not sure. There are two stances:
- Fail-open: let it through when in doubt. Convenient, never in the way - but every gap in judgment becomes an open door.
- Fail-closed: block or ask when in doubt. Occasionally inconvenient - but an unclear case never quietly turns into damage.
For a door lock the choice is obvious: a locking system that simply springs open on a power outage is no safeguard. With AI agents, the same logic is often forgotten.
Why agents in particular need fail-closed
- Persistence: whatever gets into the Memory Files stays there. A fail-open mistake isn’t fleeting - it settles in.
- Autonomy: nobody is watching every action. The safe default has to be built in, not dependent on human vigilance.
- Ambiguity: malicious entries look like legitimate ones. A model will often be “rather unsure” - and that's exactly when it must not wave things through.
How the poison0 agent puts fail-closed into practice
The poison0 agent reviews every change to your protected Memory Files and sorts it into one of three outcomes: a clearly harmless edit passes, a clearly dangerous one is reverted, and anything in between - neither obviously safe nor obviously an attack - is never quietly accepted.
For that unclear middle, what happens next depends on whether someone is there to answer. When you're at the device, the poison0 agent asks you right there: keep it or reject it, within a short time window. If nobody answers - or nothing is running interactively at all (headless) - it falls back safely: the clean state is restored on disk right away and the suspect version is held aside for you to review later, asynchronously. A timeout counts as a rejection, so an unclear case never quietly turns into damage.
You draw the line yourself: how cautious the poison0 agent should be is a setting you control per agent, explained in plain language with sliders instead of config files.
The price, and why it's worth it
Fail-closed occasionally means a query that, in hindsight, turns out to be unnecessary. That's the price. Against it stands a poisoned entry that quietly skews every future decision. This asymmetry (small, visible inconvenience versus large, invisible damage) is the whole reason fail-closed wins.