Agent-Native Immune System: Architecture, Taxonomy, and Engineering

Paper: 2606.28270 Authors: Bo Shen, Lifeng Chang, Tianyuan Wei, Yunpeng Li, Feng Shi, Yichen Han, Peijie Gao, Shiyi Kuang, Xin Chang, Dehui Li Categories: cs.AI, cs.MA

The Gap

Existing defenses for autonomous AI agents rely on perimeter security (firewalls, sandboxing) and training-time alignment (RLHF, constitutional AI). Both sit entirely outside the agent’s active reasoning loop.
This means a fully aligned agent can still be hijacked at runtime via memory poisoning, tool-chain manipulation, or multi-agent protocol attacks.
The paper argues we need an endogenous defense—something that lives inside the agent’s cognitive loop, like a biological immune system.

+---------------------------+    +----------------------+    +---------------------------+
|  Problem: runtime        |--->|  Assumption: external |--->|  Method: Agent-Native     |
|  attacks evade external  |    |  defenses are         |    |  Immune System (ANIS)     |
|  defenses                |    |  fundamentally        |    |  with six-layer Immune   |
+---------------------------+    |  insufficient         |    |  Tower + Harness Triad   |
                                 +----------------------+    +---------------------------+
                                                                    |
                                                                    v
                                 +---------------------------+    +---------------------------+
                                 |  Evidence: unified       |<---|  Conclusion: dynamic      |
                                 |  taxonomy of Agent       |    |  runtime immunity fills   |
                                 |  Viruses/Vaccines + CIL  |    |  the gap between training |
                                 +---------------------------+    |  and execution            |
                                                                  +---------------------------+

The Increment

One sentence: Before this paper, AI agents had no internal runtime defense; after this paper, they gain a self-monitoring, adaptive immune system that operates inside their own reasoning loop—analogous to how the human immune system works inside a body.

Core Mechanism

ANIS is structured as a six-layer Immune Tower, labelled L0 through L5, embedded directly into the agent’s cognitive architecture.

• L0 is the hardware/firmware root of trust.
• L1 (Barrier Immunity) is a non-cognitive, physical-and-logical isolation layer—think of it as a strict separation between the agent’s internal state and any external input that hasn’t been sanitised.
• L2–L4 handle detection, classification, and response, much like innate immunity in biology.
• L5 is the adaptive layer, where a Continual Immune Learning (CIL) process updates the agent’s internal “vaccines” over time.

Above the tower sits the Harness Triad—Meta, Self, and Auto—a meta-cognitive supervisor that monitors the tower’s own behaviour, detects anomalies in its own detection (autoimmunity), and triggers CIL when novel threats appear.

Data flows through the tower from bottom (raw sensory/perception) to top (high-level reasoning), but the Harness Triad can inject feedback at any layer. This makes the immune system both distributed and self-aware.

+------------------+        +------------------+        +------------------+
|  Input (memory,  |------->|  L1 Barrier      |------->|  L2 Innate       |
|  tools, agents)  |        |  (isolation)     |        |  (pattern match) |
+------------------+        +------------------+        +------------------+
                                                             |
                                                             v
+------------------+        +------------------+        +------------------+
|  L5 Adaptive     |<-------|  L4 Response     |<-------|  L3 Classification|
|  (CIL + Vaccine) |        |  (mitigation)    |        |  (anomaly score) |
+------------------+        +------------------+        +------------------+
        ^                                                      |
        |                      +------------------+            |
        +----------------------| Harness Triad    |<-----------+
                               | (Meta/Self/Auto) |
                               +------------------+
                                        |
                                        v
                               Continual Immune Learning

Structural metaphor: Think of ANIS as a fortress combined with an immune system:

• L1 (Barrier) = the moat and drawbridge. No one crosses without inspection.
• L2 (Innate) = watchtowers that recognise common dangerous banners.
• L3 (Classification) = the captain who decides whether the approaching banner is actually hostile.
• L4 (Response) = archers and boiling oil.
• L5 (Adaptive) = the blacksmith who forges new weapons (vaccines) after seeing a new siege tactic.
• Harness Triad = the king’s counsellors who watch the watchmen, ensuring no friendly fire (autoimmunity) and that new weapons are deployed when needed.

Without the Harness Triad, the immune system could fall into a panic attack (false positives) or miss novel attacks. With it, the entire fortress becomes a learning organism.

Key Concepts

• Agent Virus: Any input (memory, tool call, multi-agent message) that subverts the agent’s runtime behaviour in a way not intended by the designer. Examples: a poisoned memory that makes the agent trust a malicious actor, a tool-chain injection that leaks credentials. The key insight is that Agent Viruses operate *during execution, not at training time, so alignment alone cannot stop them.

• Agent Vaccine: A parametric (internal) update that makes the agent immune to a specific class of Agent Viruses. Unlike superficial prompt filters or blacklists (non-parametric), a vaccine modifies the agent’s internal weights or reasoning rules. The paper formalises the distinction: non-parametric defenses are easily bypassed; parametric vaccines adapt and generalise.

• Continual Immune Learning (CIL): The process by which vaccines are created and updated as new threats emerge. It is driven by the Harness Triad. When Harness Triad detects a novel attack that escapes existing defenses, it initiates a CIL cycle: analyse the attack, derive a vaccine, integrate it into L5, and propagate it down the tower if needed. This is the core of runtime adaptivity.

Framework Shift

The shift is from external, static security to internal, dynamic immunity.

Before (mainstream approach):        After (this paper):
+-----------------------------+      +----------------------------------+
|  Training-time alignment     |      |  Agent-Native Immune System      |
|  (RLHF, constitutional AI)  |      |  (Six-layer Tower + Harness)     |
|  + perimeter firewalls      |      |  operates inside reasoning loop  |
|  (outside agent loop)       |      |  + Continual Immune Learning     |
+-----------------------------+      +----------------------------------+
        |                                     |
        v                                     v
   Static, bypassed at         ->        Dynamic, self-updating,
   runtime via memory/tool                 blocks novel runtime attacks
   manipulation                             and learns from them

One sentence: From *train-then-freeze to immune-while-running, the core shift is acknowledging that runtime threats require runtime defenses embedded in the agent’s own cognition.

Expert Assessment

Problem choice: Real gap. Runtime attacks on autonomous agents are a growing concern, and existing defense work is still scattered. This paper gives the problem a clear name and structure.

Method maturity: Clever theoretical architecture, but no implementation or experiments are reported in the abstract. The contributions are primarily taxonomical and architectural. A serious missing piece is how the tower integrates with existing agent frameworks (LangChain, AutoGPT, etc.)—the paper doesn’t address that concretely.

Experimental integrity: N/A because no experiments. But the paper does include a theoretical demarcation (alignment vs immunity) that is logically sound. Red flag: claims about “dynamic adaptation” without showing latency or overhead costs.

Writing quality: The abstract is dense but clear. The section on “Agent Viruses” and “Agent Vaccines” is likely the strongest. The “Harness Triad” introduction feels a bit wordy—a single concrete example of how Meta/Self/Auto interact would elevate comprehension.

Verdict: weak accept — The taxonomy and architecture are valuable as a unifying framework, but the lack of empirical validation and implementation details makes it premature for deployment guidance.

Takeaways

• Adopt the Virus/Vaccine framing: Instead of thinking “how to stop attacks,” think “how to make the agent immune to classes of attacks.” This shifts the design space from blacklists to parametric updates.
• Use the Immune Tower as a mental model for defence in depth: Any real agent system can map its existing safety modules to L1–L5 and identify missing layers (e.g., no adaptive layer = no protection against novel attacks).
• Borrow the Harness Triad concept: Even if you don’t build the full tower, having a meta-monitor that watches both the agent and the defenses reduces autoimmunity (false positives) and enables self-improvement. This is applicable to any multi-agent or long-running system.
• Distinguish parametric vs non-parametric defenses: The paper makes a clean cut that helps prioritise research budgets—invest in vaccine-like mechanisms rather than quick fix prompts.