One runtime boundary between your agent and the world.

Put AI agents to work in real systems without giving up control.

How do agents reach your systems?

Choose which systems and actions the agent can use. STACK keeps credentials out of its reach, denies requests outside those limits and records every action it handles.

See how the install works

STACK exists because of what happens when access goes further than intended.

Shai-HuludSelf-propagating npm wormMay 2026

A stolen npm token let malicious packages republish compromised versions across everything the maintainer controlled.

639 malicious versions across 323 packages in the May wave.

Credential isolation

When the credential stays in STACK and is injected only for a permitted call, malware in the agent runtime has no npm token to steal or reuse.

Copirate 365Persistent Copilot prompt injection · CVE-2026-24299Mar 2026

A poisoned document planted instructions in Microsoft 365 Copilot’s memory. Later conversations could then leak passwords, codes or other data without the user reopening the document.

Copilot provided no audit log for memory changes, so the malicious instruction could remain hidden.

Prompt-injection enforcement

Before an agent sends a memory-write call, STACK scans the request for prompt injection. In enforced mode, a critical match blocks the call and records the decision in the hash-chained audit log.

Mastranpm supply-chain attackJun 2026

A compromised maintainer account published malicious versions of more than 100 Mastra packages. Installing one ran an infostealer automatically on developer machines and CI runners.

Credential isolation

STACK keeps service credentials out of the agent runtime and injects them only for approved calls. The malware would find no provider keys to steal from the machine.

1 of 5