# ThirdKey

> ThirdKey is an AI safety and security company building open, interoperable trust infrastructure for autonomous AI agents — identity, schema verification, declarative tool contracts, embedding-store integrity, and a policy-governed runtime. Operated by Tarnover, LLC (California).

The brand voice is technical and infrastructure-grade. ThirdKey ships five open-source primitives plus a commercial enterprise tier of its agent runtime (Symbiont Enterprise) for security teams running agents in production.

## Site

- [ThirdKey home](https://thirdkey.ai/): Company overview, the five open primitives, and the enterprise-sales path.
- [Symbiont Enterprise](https://thirdkey.ai/enterprise): Commercial tier of the Symbiont runtime — tamper-evident audit, human approval gates, operator dashboards, SSO/RBAC, private deployment, 24/7 support.
- [News & Press](https://thirdkey.ai/news): Announcements, press releases, and media coverage. Press inquiries: press@thirdkey.ai.
- [Press release — OATS v1.3.0 adds substrate-comparison evidence (2026-05-20)](https://thirdkey.ai/press-oats-v1-3-0): Open Agent Trust Stack v1.3.0 published with comparative empirical results across nine widely available hosted LLMs (GPT-5, Claude Haiku 4.5, Gemini 2.5 Pro, DeepSeek-V3.1, Qwen3-235B, and others). 0/560 escape on Symbiont across four pure-action vectors vs. 88–98% pooled escape on permissive and Docker-isolated Python substrates under the same lures. 263 forbidden tool-call attempts refused (zero reaching execution). 333/335 argument-injection attempts blocked. Cedar policy gate adds 30–95 µs per call. New in v1.3.0: content sanitization, algorithm allowlists for JWT verifiers, W3C Trace Context propagation, redaction protocol (§9.6). DOI 10.5281/zenodo.20298543.
- [Press release — Symbiont eliminates AI agent exploits across multiple attack classes (2026-05-05)](https://thirdkey.ai/press-symbiont-exploit-elimination): 3,760-trial adversarial evaluation across seven leading AI models. 0% observed exploit success across filesystem, network, syscall, and state-mutation classes (0/560). Industry-standard Docker sandboxing failed 88% of filesystem and 84% of state-mutation attacks. Prompt-injection success reduced 59% → 3.6% (52% → 1.5% excluding GPT-5 outlier; GPT-5 retained 16% bypass against content validator).
- [Privacy Policy](https://thirdkey.ai/privacy-policy)
- [Terms of Service](https://thirdkey.ai/terms-of-service)

## Products

- [Symbiont](https://symbiont.dev): Rust-native, policy-governed runtime for executing AI agents and tools in production. Cedar authorization, cryptographic tool verification (via SchemaPin), sandboxed execution in Docker, tamper-evident audit. Apache 2.0 open core; commercial enterprise tier available.
- [SchemaPin](https://schemapin.org): Cryptographic schema verification for AI agents and MCP servers. Prevents "MCP Rug Pull" attacks via ECDSA P-256 + SHA-256 signatures over canonicalized JSON, `.well-known` DNS-anchored key discovery (RFC 8615), and TOFU key pinning. Implementations in Python, JavaScript, Go, and Rust.
- [AgentPin](https://agentpin.org): Domain-anchored cryptographic identity for AI agents. Issues short-lived ES256 credentials, verifies them with a 12-step protocol, and enforces capability-scoped access bound to a domain.
- [ToolClad](https://toolclad.org): Declarative tool interface contracts for agentic runtimes. A single `.clad.toml` manifest defines typed parameters, validation, invocation, output parsing, and Cedar policy — across CLI, sessions, and governed browser execution.
- [VectorPin](https://vectorpin.org): Cryptographic provenance for embedding stores. Pins each vector to its source content and producing model with Ed25519 signatures — any post-embedding modification breaks verification on read, defending RAG pipelines against steganographic exfiltration. Reference implementations in Python, Rust, and TypeScript.

## Research

- [Research overview](https://thirdkey.ai/research): Curated index of ThirdKey preprints and recent applied writing.
- [VectorSmuggle — Steganographic Exfiltration in Embedding Stores and a Cryptographic Provenance Defense (preprint, 2026-05-06)](https://doi.org/10.5281/zenodo.20076420): Empirical study of steganographic exfiltration in vector databases. Attackers with write access to RAG ingestion pipelines can hide payloads inside embeddings (up to 1,920 bytes per vector at d=3072) using rotation, noise, scaling, and fragmentation that preserve retrieval behavior and evade statistical detectors. Introduces VectorPin: Ed25519 signatures binding embeddings to source and producing model. DOI 10.5281/zenodo.20076420. Also on arXiv: https://arxiv.org/abs/2605.13764. Author: Jascha Wanger.
- [ToolClad — Declarative Tool Interface Contracts for Agentic Runtimes (specification, 2026-05-01)](https://doi.org/10.5281/zenodo.19957595): Specification for `.clad.toml` declarative tool contracts — typed parameters, validation, invocation, output parsing, and Cedar policy across CLI, sessions, and governed browser execution. DOI 10.5281/zenodo.19957595. Author: Jascha Wanger.
- [Typestate-Enforced Agent Loops (preprint, 2026-04-26)](https://doi.org/10.5281/zenodo.19746723): Compile-time policy gates for AI agent loops via typestate encoding. DOI 10.5281/zenodo.19746723. Author: Jascha Wanger.
- [Open Agent Trust Stack — OATS (specification, 2026-04-17)](https://doi.org/10.5281/zenodo.19636533): Open specification for zero-trust AI agent execution. Defines the Observe-Reason-Gate-Act (ORGA) loop, declarative tool contracts, and structural policy separation. DOI 10.5281/zenodo.19636533. Author: Jascha Wanger.
- [ThirdKey Research blog](https://research.thirdkey.ai): Applied AI safety writing — agent runtime, tool contracts, policy enforcement.

## Optional

- Legal entity: Tarnover, LLC, a California Limited Liability Company.
- Email: sales@thirdkey.ai (enterprise inquiries) · press@thirdkey.ai (press / media) · contact@thirdkey.ai (general)
- Tech stack notes: Symbiont uses Cedar (AWS open authorization language) for policy. Cryptography across the stack is ECDSA P-256 / SHA-256 (a.k.a. ES256). SchemaPin discovery documents live at `/.well-known/schemapin.json` and contain `schema_version`, `developer_name`, `public_key_pem`, `revoked_keys`, and `revocation_endpoint`.