Five Slices of Swiss Cheese Between Your Agent and Everyone Else

Key Takeaways

• KiloClaw uses five independent isolation layers for tenant security.
• Layers include auth, app, network, process, and storage isolation.
• Independent assessment found no cross‑tenant vulnerabilities in 35 tests.
• Exec tool requires explicit user approval, preventing prompt‑injection bypass.
• Encryption keys are destroyed on instance deletion, ensuring data unrecoverability.

Pulse Analysis

James Reason’s Swiss‑cheese model, born from aviation and healthcare failures, illustrates how multiple imperfect safeguards can collectively reduce risk to near zero. In the context of AI agents—software that can run shell commands, browse the web, and wield API keys—the stakes are dramatically higher than for conventional SaaS products. A single breach could grant an attacker not only data access but also the ability to act on behalf of the compromised tenant, making defense‑in‑depth a non‑negotiable design principle.

KiloClaw translates this theory into practice with five distinct isolation slices. Authentication and access control prevent insecure direct object references by routing requests based on server‑side identities. Each customer runs in a dedicated Fly.io application, ensuring application‑level separation, while WireGuard meshes enforce network isolation verified by third‑party testing. Process isolation leverages Firecracker microVMs—hardware‑level virtualization trusted by AWS Lambda—to contain any malicious prompt injection within a single VM. Finally, encrypted storage volumes and a two‑phase key destruction process guarantee that data cannot be recovered once an instance is terminated.

A February 2026 independent security assessment, employing the PASTA threat‑modeling framework and 35 adversarial tests, reported zero cross‑tenant access paths, SQL injection, XSS, or command injection findings. The assessment also produced 17 pull‑request improvements, underscoring the value of rigorous external validation. For enterprises adopting AI‑agent platforms, KiloClaw’s layered approach offers a blueprint for mitigating the unique risks of executable agents, reinforcing the broader industry shift toward comprehensive, multi‑layered security architectures.