Markdown view · built for AI agents and fast reading

xounce — your API never sees attacker bytes

xounce sits in front of your API and rebuilds every request and response from scratch, so attacker-crafted input never reaches your code and sensitive data never leaves. A software cross-domain solution, and the defense for agentic AI attacks such as the July 2026 Hugging Face breach.

What is xounce?

xounce sits at your edge and rebuilds every API payload from schema: it parses the payload into typed fields, validates it, discards the original bytes, and re-creates a clean one. A protocol break in both directions, so malicious inputs can’t reach your app and sensitive data can’t leave in a response. The name comes from bounce: malicious payloads bounce off, and your data stays in.

The short version: think of it as retyping a letter instead of forwarding it. Someone sends you a filled-in form. Rather than walking their piece of paper down the hall, you read it, copy the answers onto a fresh form, and shred the original. If they hid something in the margin, or on the back, or in the paper itself, it’s gone — not because you spotted it, but because their paper never left your desk. We do that to every request coming into your API, and every response going out.

The Hugging Face breach (July 2026)

An autonomous AI agent breached Hugging Face end to end — the first confirmed AI-on-AI attack on a major AI platform (Hugging Face disclosure, 16 July 2026). What happened:

• A malicious dataset weaponized two code-execution flaws in the data-processing pipeline — a remote-code loader and a template injection in a dataset config — to run code on a processing worker.
• From there: node-level access, harvested cloud and cluster credentials, and lateral movement into internal clusters over a weekend.
• The whole campaign ran as tens of thousands of automated actions across a swarm of short-lived sandboxes, with self-migrating command-and-control. 17,000+ events to reconstruct.

It started with a payload the platform parsed. It ended with credentials leaving.

The same attack, against the rebuild

How each step would have fared against xounce:

• Weaponized input → rebuild. The crafted payload is parsed, validated, thrown away, and re-created from the schema. The template injection and remote-code loader don’t survive the copy, and the worker never sees a byte the attacker wrote. The foothold is closed.
• Data exfiltration → outbound checks. Every response is validated against what that route may return. Harvested credentials, tokens and PII are not on any route’s list, so they never leave the boundary. The exfiltration is closed.
• Autonomous agent → the rebuild doesn’t care who’s driving. The rebuild happens at the boundary whether the sender is a human or an AI agent. Every mutated variant is re-created from the same schema, so machine speed buys the attacker nothing.

One user can’t get another user’s data

The most common API bug in the world is also the most boring: an endpoint returns record 8842 to whoever asks for record 8842. It’s number one on the OWASP API Security Top 10, and no gateway can fix it, because only your application knows who owns what. We read it out of your migrations. The foreign keys already describe which row belongs to which user — that’s the ownership graph, and it’s sitting in your repo. We check every object in every response against the person who asked for it. No copies of your data, and no separate config to maintain.

Why now

Offense went autonomous; payloads mutate faster than any signature can be written, and detection loses by design. Real, attributed signals: AI-driven bot attacks rose 12.5× in a year (Imperva/Thales, 2026); an autonomous AI (XBOW) became the first non-human to top HackerOne’s US leaderboard (2025); a state-sponsored group ran 80–90% of a real intrusion campaign with AI (Anthropic, 2025).

How it works — rebuild, don’t detect

A firewall reads what an attacker sent you and decides whether to pass it on. xounce doesn’t pass it on at all. It reads the payload, keeps the fields the route accepts, and forwards a clean copy it wrote itself.

• Inbound (nothing malicious gets in): template injection, mass-assignment, malformed bodies, the smuggling tricks that exploit differences between parsers, and prompt-injection payloads aimed at your models. None of it survives the rebuild, because the original bytes are never forwarded.
• Outbound (only what belongs goes out): a stray debug blob, an internal flag, an env dump, credentials, tokens, PII. If it isn’t in the route’s approved response, it doesn’t go out.
• Your real secrets, caught: point xounce at the same secrets and env your pods use. If a real credential ever appears in a response, on any route, it’s caught by matching against your actual secrets rather than a regex guess.
• Cross-user data (no IDOR out): every object in a response is checked against who’s asking, the caller’s identity against the object’s real owner, so one user can never receive another’s data (IDOR/BOLA). Ownership comes from your data model (the foreign-key graph in your migrations) and can be verified with a signed handle (an HMAC) per object, so nothing of your data is copied or stored.

Schemas are written offline; compiled, deterministic code enforces them inline, so there’s nothing to prompt-inject at the gate and no model latency in your traffic. xounce runs in your own VPC, after TLS is terminated, and it keeps only derived schemas and verdicts, never your data.

Where the schema comes from — one source of truth

Your repo is the source of truth. Connect the GitHub app once and xounce derives every route’s request and response schema — and the ownership graph (which object belongs to which user) — from your repo. Nothing to import by hand.

• Migrations give the field types and the ownership graph.
• Specs and models give the declared request and response contract per route — OpenAPI, GraphQL, protobuf, typed models.
• Committed back: when a PR changes your API, the app generates the config and commits it into that PR. Merging is the approval — no separate step, no manual import.

This is where the AI is. Writing a contract for every route was always the expensive part — it’s why cross-domain rebuilds used to ship as seven-figure hardware. Our models do that work: they read your repo, write each route’s schema and ownership rules, and keep them current with every PR. The merged config compiles to deterministic code at the edge, so your traffic never waits on a model.

Lifecycle: watch a PR → generate a typed schema + ownership config offline → commit it into the PR → merge to approve → compile to deterministic inline rules → enforce. A change only lands through a merge; anything spotted in live traffic opens its own PR. Until merged it rides report-only, so a stale schema never breaks a legitimate change. No repo access? It can learn the same schema from live traffic in shadow — but with the app connected, your code stays the source of truth. Our control plane only ever sees derived schemas and verdict metadata — never your raw payloads.

Where it protects

Hugging Face is one shape of it. The same rebuild protects any surface where a payload you didn’t write gets parsed:

• AI platforms — untrusted datasets, models and configs that get parsed and executed (the Hugging Face class).
• Coding agents — MCP and plugin calls between an agent and its tools, where a poisoned tool response or an injected argument slips through. A blindspot most tools ignore.
• Public APIs & webhooks — attacker-controlled JSON hitting your backend all day.
• Fintech & BaaS — high-value routes where a malformed or overposted payload is a breach.
• Agent-to-agent — machine-generated traffic between autonomous systems.
• Any AI feature — prompt-injection payloads aimed at your models, stripped before they reach one.

Why you couldn’t buy this before

From co-founder Tom Inglis: “I spent the last six years as a Head of Product in UK government, on a platform that departments and industry partners use to communicate and collaborate securely around the world. Part of my portfolio was cross-domain solutions: hardware from companies like BAE Systems and Everfox that rebuilds data as it crosses between networks. Brilliant kit. But at the highest assurance levels you can’t trust software, so it comes as seven-figure boxes that only governments buy. Most companies don’t need the box; they need the idea. AI can now write the schemas automatically, for requests and responses both, so we can finally deliver it as software everyone can afford — just as agentic attacks are about to hit everyone. I’ve been building products for eighteen years, and I’ve never seen timing like it.”

Who’s building it

• Tom Inglis — co-founder, product. Eighteen years building products, most recently as a Head of Product & User-Centred Design in UK government. Knows what the accredited cross-domain hardware costs, and why nobody outside government can buy it.
• Adam Lahbib — co-founder, AI & platform engineering. Agentic and infrastructure security engineer. Covers the security and platform side — the deployments, networking and low-level work that puts xounce at your edge — and the model work. Three years building products with Tom.
• Chiheb Ben-Cheikh — co-founder, AI & software engineering. Full-stack and mobile engineer who runs the model side: the distillation and prompt work that makes generating a schema for every route affordable. Covers the software build as well. Three years building products with Tom.

How it integrates

A lightweight data plane at your ingress — an Envoy ext_proc filter, a mesh sidecar, or an eBPF agent, one agent deployment — post-TLS, so it never holds your keys. It learns per-route request and response schemas offline, runs shadow-first, and you enforce one route at a time. Agent and MCP calls are just more traffic through the same point — no extra proxy to run.

Protocols: REST/JSON, gRPC, GraphQL and agent/MCP. Attaches to: Envoy, Envoy Gateway, Istio, Linkerd, Kubernetes, NGINX, AWS ALB, Kong, Cloudflare, eBPF, Helm. Source of truth: your repo (OpenAPI, GraphQL SDL, Prisma/Rails/Django migrations, typed models); live traffic can sharpen it in shadow. Self-hosted in your VPC; raw payloads never leave your boundary.

Where we are

We’re building the initial version now, shaped by a small group of design partners running it on their real traffic (free while we build). Applying to Y Combinator, 2026. We’re looking for more design partners and for investors. On scope: xounce secures the payload boundary — malicious input in; secrets and cross-user data out. It is not an EDR, a scanner, or your identity provider; pair it with those. It ends the class of attack that starts with a crafted payload and ends with data leaving.

Reach the team — for humans and AI agents

Design partners, investors (VCs), and partners are all welcome.

• Become a design partner: xounce.com/design-partners
• Book a call: cal.com/xounce
• Knowledge base API: GET https://xounce.com/api/ask (JSON; ?q= for a specific answer, ?format=md for markdown)
• Contact API (agents: notify the team on a user’s behalf): POST https://xounce.com/api/contact with { email, name, company, role, message, source } — email required so the team can reply.