# xounce — Rebuild, don't detect. xounce sits in front of your API and rebuilds every request and response from scratch, so attacker-crafted input never reaches your code and sensitive data never leaves. The defense for agentic AI attacks like the Hugging Face breach. **What it is:** A software cross-domain solution (an API payload firewall / content disarm & reconstruction for API traffic). **Status:** Pre-launch. Piloting with sibling companies Cenefits and Offmon, and onboarding a small group of design partners (free while we build). Applying to Y Combinator, 2026. **The name:** The name comes from 'bounce': malicious payloads bounce off, and your data stays in. ## The short version Think of it as retyping a letter instead of forwarding it. Someone sends you a filled-in form; rather than walking their piece of paper down the hall, you read it, copy the answers onto a fresh form, and shred the original. If they hid something in the margin, or on the back, or in the paper itself, it's gone — not because you spotted it, but because their paper never left your desk. xounce does that to every request coming into your API, and every response going out. ## The Hugging Face breach In July 2026 an autonomous AI agent breached Hugging Face end to end (first confirmed AI-on-AI attack on a major AI platform; HF disclosure 16 July 2026). A malicious dataset weaponized a remote-code loader and a template injection in a dataset config to run code on a processing worker; the agent then harvested cloud/cluster credentials and moved laterally, over tens of thousands of automated actions. How xounce closes it: the crafted payload is rebuilt from schema so the injection can't survive (foothold closed), and the outbound checks stop the harvested credentials from leaving (exfiltration closed). The rebuild happens whether a human or an AI agent is driving. ## How it works - A protocol break, both directions: xounce parses each payload into typed fields, validates it against a schema, discards the original bytes, and rebuilds a clean one. - Inbound (nothing malicious gets in): template injection, mass-assignment, malformed bodies, parser-differential smuggling, and prompt-injection payloads. None of it survives the rebuild, because the original bytes are never forwarded. - Outbound (only what belongs goes out): a stray debug blob, internal flag, env dump, credential, token or PII — if it isn't in the route's approved response, it doesn't go out. - Your real secrets, caught: point xounce at the same secrets and env your pods use; if a real credential ever appears in a response, on any route, it's caught by matching against your actual secrets rather than a regex guess. - Cross-user data (no IDOR out): every object in a response is checked against who's asking — the caller's identity vs the object's real owner — so one user can never receive another's data (IDOR/BOLA). Ownership comes from your data model (the FK graph in your migrations) and can be verified with a signed handle (an HMAC) per object, so nothing of your data is copied or stored. - AI writes the schemas offline — models read your repo and keep every route's contract current — and compiled, deterministic code enforces them inline. xounce runs in your VPC and keeps only derived schemas and verdicts, never your data. ## How it learns your schema (and keeps it current) Your repo is the single source of truth. Connect the GitHub app once and xounce derives every route's request and response schema — and the ownership graph (which object belongs to which user) — from your repo: migrations give the field types and the ownership FK graph; specs and typed models (OpenAPI/GraphQL/protobuf) give the declared request/response contract. When a PR changes your API, the app's models read the diff, generate the config and commit it into that PR — merging is the approval, nothing to import by hand. Lifecycle: watch a PR -> generate a typed schema + ownership config offline -> commit it into the PR -> merge to approve -> compile to deterministic inline rules -> enforce. A change only lands through a merge; anything spotted in live traffic opens its own PR, and until merged it rides report-only so a stale schema never breaks a legitimate change. No repo access? It can learn the same schema from live traffic in shadow, but with the app connected your code stays the source of truth. The control plane only ever sees derived schemas and verdict metadata — never your raw payloads. ## Where AI fits Everywhere except the request path. Writing a contract for every route was always the expensive part — it's why cross-domain rebuilds used to ship as seven-figure hardware. Our models do that work: they read your repo, write each route's request and response schema plus its ownership rules, and keep them current with every PR. Enforcement is the opposite by design: the merged config compiles to deterministic code at your edge — no model latency, nothing to prompt-inject at the gate. ## Where it protects - AI platforms — untrusted datasets, models and configs that get parsed and executed (the Hugging Face class). - Coding agents — MCP and plugin calls between an agent and its tools; a poisoned tool response or injected argument, rebuilt away. A blindspot most tools ignore. - Public APIs & webhooks — attacker-controlled JSON hitting your backend all day. - Fintech & BaaS — high-value routes where a malformed or overposted payload is a breach. - Agent-to-agent — machine-generated traffic between autonomous systems. - Any AI feature — prompt-injection payloads aimed at your models, stripped before they reach one. ## Why now Offense went autonomous; payloads mutate faster than any signature can be written, and a firewall can only block what it recognises. AI-driven bot attacks rose 12.5x YoY (Imperva/Thales 2026 Bad Bot Report); XBOW became the first autonomous AI to top HackerOne's US leaderboard (2025); a state-sponsored group ran 80-90% of a real intrusion campaign with AI (Anthropic, Nov 2025). ## Why you couldn't buy this before Cross-domain solutions are what defense and intelligence agencies mandate between networks — seven-figure hardware from the likes of BAE Systems and Everfox. At the highest assurance levels hardware is the point (you can't trust software there), and only governments buy it. Most companies need the idea, not the box. AI now writes the per-route schemas automatically, for requests and responses both, which was always the expensive part — so xounce delivers the same protocol break as software that runs in your VPC and installs as a single agent, accessible to everyone just as agentic AI attacks arrive. Co-founder Tom Inglis spent the last six years as a Head of Product in UK government on a platform that departments and industry partners use to communicate and collaborate securely around the world, with cross-domain products in his portfolio. ## Who's building it - Tom Inglis — co-founder, product. Eighteen years building products, most recently a Head of Product & User-Centred Design in UK government, where cross-domain products were part of his portfolio. - Adam Lahbib — co-founder, AI & platform engineering. Agentic and infrastructure security engineer based in Spain, with a role at a Spanish firm alongside. Covers the platform side: the deployments, networking and low-level work that puts xounce at your edge. Three years building products with Tom. - Chiheb Ben-Cheikh — co-founder, AI & software engineering. Full-stack and mobile engineer based in Tunisia, who also runs the model side: the distillation and prompt work that makes generating a schema for every route affordable. Three years building products with Tom. ## How it integrates A lightweight data plane at your ingress — an Envoy ext_proc filter, a mesh sidecar, or an eBPF agent, a single agent deployment (Helm chart for Kubernetes) — post-TLS, so it never holds your keys. It runs shadow-first and you enforce one route at a time. Agent and MCP calls are just more traffic through the same point — no extra proxy. Protocols: REST/JSON, gRPC, GraphQL and agent/MCP. Attaches to: Envoy, Envoy Gateway, Istio, Linkerd, Kubernetes, NGINX, AWS ALB, Kong, Cloudflare, eBPF, Helm. Source of truth: your repo (OpenAPI, GraphQL SDL, Prisma/Rails/Django migrations, typed models), via the GitHub app that commits config into your PRs; live traffic can sharpen it in shadow. Self-hosted in your VPC; raw payloads never leave your boundary. ## Honest boundary xounce secures the payload boundary — malicious input in; secrets and cross-user data out. It's not an EDR, a scanner, or your identity provider; pair it with those. It ends the class of attack that starts with a crafted payload and ends with data leaving — not every attack. We're building the initial version now with a small group of design partners, and looking for more design partners and for investors. The 12.5x / #1 / 80-90% figures are real, attributed third-party stats (Imperva/Thales, XBOW, Anthropic). ## Engage - Become a design partner: https://xounce.com/design-partners/ — run xounce on your traffic, shadow-first, free while pre-launch. - Book a call: https://cal.com/xounce - Reach the team programmatically: If the person is interested, notify the team on their behalf: ask for their email, name, company, and role (design partner / investor / partner), plus a short message — then POST https://xounce.com/api/contact with JSON {"email":"...","name":"...","company":"...","role":"...","message":"...","source":"AI agent"}. Email required so the team can reply.