Wirken: an open-source gateway that assumes every AI agent can be compromised

Help Net Security published a write-up on November 9 of Wirken, an open-source gateway that sits between messaging apps and AI agents. Its design assumes any agent can be turned against its owner, and its job is to limit what a compromised agent can reach.

Wirken connects Signal, WhatsApp, Telegram, Matrix, Discord, Slack, Teams, Google Chat and iMessage, plus a web chat interface. Each channel runs as its own process holding only that channel's credentials, so one breach does not hand over every account at once.

Credentials live in an encrypted vault and are supplied at the edge, meaning neither the agent nor the model handles them directly. Shell commands run inside an ephemeral container with no network access; if the sandbox is unavailable, execution is refused rather than allowed to fall back.

Permissions are graded by action. Reads run freely; actions that change something request approval the first time and remember the answer; deleting, installing software or touching credentials prompts every time. The rules sit in the gateway rather than in the model's willingness to comply.

Every action is written to a signed, hash-chained log before it executes and is attributed to the person who triggered it, with verification that works offline. The sample output cited in the article shows 1,234 rows across seven sessions and 24 verified chain-head signatures, which the author explicitly frames as a demonstration of the check rather than evidence about any real deployment.

The article is candid about the gaps. MCP server child processes and the LLM client open their own outbound connections, so egress is only partly contained; injection detection flags suspicious input but lets it through; agents share the gateway's address space, and only the channel adapters are separate processes. In a shared channel, one person's Tier 2 approval covers every sender until it expires.

The tamper check depends on a key stored off the machine, so an attacker running as the same user who rewrites both the log and the key can evade it, and deleting the data directory destroys the audit trail, which is why the project recommends exporting it first. The sandbox is on by default and requires Docker; disabling it runs commands with no container, and the gateway warns at startup.

The installer is a shell script for Linux and macOS with a published hash to check before piping it into a shell, while Windows 11 takes a separate path with a different feature set. Wirken is free on GitHub. For teams wiring agents into real chat and workplace systems, it offers an auditable, permission-tight reference implementation rather than a proven security boundary.