xounce

Rebuild, don’t detect.

Your API never sees attacker bytes — and nothing leaves that shouldn’t.

a 60-second look

xounce control plane · your VPC
prod · enforcing 4/6 routes · data plane healthy
48,210
payloads rebuilt · today
312
malicious · bounced
41
off-contract fields · stripped
7
cross-user reads · blocked
Routes · learned from your reposchema v142
routemodecoveragetoday
POST /datasetsenforce100%18,204
GET /orders/:idenforce100%9,410
PATCH /users/:idenforce100%3,102
GET /meenforce100%12,881
POST /webhooks/stripeshadow97%4,613
MCP · tools/callshadow92%1,209
Live · both directions● rebuilding
    PR #143 · adds a field to /datasets →config committed into the PR ✓ →merged ✓ →compiled ✓ →enforcing merge is the approval
    Inbound · POST /datasetscross-domain rebuild
    received · attacker bytesuntrusted
    {
  "name": "imagenet-mini",
  "loader": "__reduce__ …",
  "config": "{{ os.system(…) }}"
}
    rebuild
    forwarded · written by xounceclean
    {
  "name": "imagenet-mini"
}

// the injection didn't
// survive the copy
    Outbound · GET /orders/42DLP · response rebuild
    from your appleaks
    {
  "id": 8842,
  "aws_key": "AKIA…",
  "cluster_token": "k8s-…",
  "ssn": "409-52-…"
}
    rebuild
    sent ononly what belongs
    {
  "id": 8842
}

// secrets matched against
// the ones your pods use
    GET /orders/42 — requested by user u_7715 object owner u_2201 ≠ caller u_7715
    blocked · IDOR / BOLA

    part two · july 2026

    An AI agent broke into
    Hugging Face in a weekend.

    No human at a keyboard. Replay it — with xounce deployed at the edge.

    step 01 · entry

    A poisoned dataset lands in the pipeline

    A remote-code loader and a template injection hide inside the dataset’s config. The platform parses the file — and the attacker’s code runs on a processing worker.

    what happened · code ran on a worker
    where xounce intervenes

    The upload crosses the boundary first: parsed into typed fields, validated against the route’s schema, discarded, and rewritten. The loader and the template don’t survive the copy.

    in → POST /datasets · loader, template config  bounced ✗  ·  clean copy forwarded ✓
    the worker parses a file xounce wrote — nothing runs

    step 02 · the foothold

    Credentials are harvested, the agent moves

    The worker held cloud and cluster credentials. The agent took them and moved into internal clusters — and kept going all weekend.

    what happened · lateral movement, all weekend
    where xounce intervenes

    No code ran, so there’s nothing to harvest. And it’s closed from the other side too: every response is checked against the real secrets your pods use — a credential can’t ride out on any route.

    out ← GET /datasets/status · aws_key  stripped  ·  alert raised ✓
    nothing to take — and no way to carry it out

    step 03 · machine speed

    Tens of thousands of automated actions

    The campaign ran as a swarm: short-lived sandboxes, self-rewriting command-and-control, payloads mutating faster than any signature could be written. 17,000+ events to reconstruct afterwards.

    what happened · 17,000+ events to reconstruct
    where xounce intervenes

    Mutation buys nothing. Every variant is copied onto the same fresh form at the boundary, whether a person or an agent sent it — and cross-user pulls are blocked against the real owner.

    in → 10,000 mutated payloads  10,000 rebuilds ✓  ·  owner ≠ caller  blocked
    every variant — the same rebuild

    July 2026

    • ✗  A crafted file ran code on a worker
    • ✗  Cloud & cluster credentials left the building
    • ✗  A weekend of lateral movement
    • ✗  17,000+ events to reconstruct

    With the rebuild at the edge

    • ✓  The upload bounced at the boundary
    • ✓  Nothing ran — and nothing could leave
    • ✓  An alert, not an incident
    • ✓  One log line to read on Monday
    xounce

    Rebuild, don’t detect.

    Cross-domain in. DLP out. One point at your edge.

    xounce.com · pre-launch · design partners open

    ← back to the site  ·  ↻ replay  ·  become a design partner →