Parallax: Why AI Agents That Think Must Never Act
2026-04-14 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors explain that current safety measures for AI agents, which rely on instructions given in natural language (prompts), are not strong enough when these agents can perform real actions like running commands or changing data. They propose a new system called Parallax that separates AI decision-making from action execution and adds layers of checks to prevent harmful actions. Parallax also tracks sensitive information and can undo changes if something risky is detected. Their open-source version, OpenParallax, was tested against many attacks and blocked nearly all threats, unlike traditional prompt-based safety that fails if the AI is compromised.
Autonomous AI agentsPrompt-level guardrailsCognitive-Executive SeparationAdversarial ValidationInformation Flow ControlReversible ExecutionOpenParallaxAgent securityAssume-Compromise Evaluation
Authors
Joel Fokou
Abstract
Autonomous AI agents are rapidly transitioning from experimental tools to operational infrastructure, with projections that 80% of enterprise applications will embed AI copilots by the end of 2026. As agents gain the ability to execute real-world actions (reading files, running commands, making network requests, modifying databases), a fundamental security gap has emerged. The dominant approach to agent safety relies on prompt-level guardrails: natural language instructions that operate at the same abstraction level as the threats they attempt to mitigate. This paper argues that prompt-based safety is architecturally insufficient for agents with execution capability and introduces Parallax, a paradigm for safe autonomous AI execution grounded in four principles: Cognitive-Executive Separation, which structurally prevents the reasoning system from executing actions; Adversarial Validation with Graduated Determinism, which interposes an independent, multi-tiered validator between reasoning and execution; Information Flow Control, which propagates data sensitivity labels through agent workflows to detect context-dependent threats; and Reversible Execution, which captures pre-destructive state to enable rollback when validation fails. We present OpenParallax, an open-source reference implementation in Go, and evaluate it using Assume-Compromise Evaluation, a methodology that bypasses the reasoning system entirely to test the architectural boundary under full agent compromise. Across 280 adversarial test cases in nine attack categories, Parallax blocks 98.9% of attacks with zero false positives under its default configuration, and 100% of attacks under its maximum-security configuration. When the reasoning system is compromised, prompt-level guardrails provide zero protection because they exist only within the compromised system; Parallax's architectural boundary holds regardless.