we found that using a stable AI-SDLC process like: https://github.com/highflame-ai/ai-factory improves code agent assisted development dramatically specially when going from 1-100.
We benchmarked Highflame's AI Gateway against popular alternatives to see how our RUST based unified (LLM/MCP) gateway performs and were surprised at how the competition fared (hint: poorly). We wrote a 2 part blog to review the performance throughput, latency, connection handling in detail.
We write about why AI agent sandboxes are insufficient. Identity, not just policy, is critical to securing autonomous AI systems and preventing misuse.
From what I can tell, agent-vault does not solve identity, only how its stored. For true agent identity, you should look into: https://github.com/highflame-ai/zeroid (author: full disclosure)
We’ve been working on security for multi-turn agent loops and noticed most detection approaches operate on isolated prompts. This paper introduces a framework for modeling intent trajectories across sequences in real time (<20ms), enabling enforcement before harmful actions occur.
Happy to answer technical questions or discuss assumptions in the paper.
We’ve spent decades hardening software supply chains — signing binaries, scanning dependencies, locking down CI/CD — yet AI models themselves are mostly treated as opaque blobs pulled from the internet. That assumption is increasingly unsafe: models can be tampered with, backdoored, or subtly manipulated to behave maliciously at runtime.
Highflame’s new tool Palisade brings a zero-trust approach to the AI model supply chain. It validates format and structural integrity, detects hidden malicious patterns, verifies provenance via Sigstore/SLSA, and can even trigger behavioral checks to surface backdoors that only activate under certain inputs. Built in Rust for speed and scalability, Palisade makes it feasible to gate models before they hit inference servers or CI/CD pipelines, turning “download and hope” into a verifiable trust boundary.
Author here — happy to answer questions about threat models, performance tradeoffs, or how this fits into CI/CD.
We recently released https://github.com/getjavelin/ramparts, a tool in the overall ecosystem designed to help protect & raise awareness of security issues in remote or locally developed MCP servers.
Its free, extensible with yara support and can be adapted to the needs of an enterprise.
Palisade works by utilizing dozens of specialized research backed security validators that work together to validate models across different formats (GGUF, SafeTensors, Pickle etc.,) and model families (BERT, Llama etc.,) for things like backdoor detection, supply chain vulnerabilities in the model files and model metadata. Any hidden embedded tool-calling logic can be activated by specific triggers which can be detected through a combination of static scan, schema analysis, trigger & instruction detection in models.
This highlights the critical need for Model Supply Chain scanning for Enterprises that adopt AI. Full disclosure, I am co-founder CEO of Javelin (www.getjavelin.com) and we ran your model through Javelin's Supply Chain Scanner (Palisade) and it immediately identified the errors: