Flexxon wins third CyberCall grant to build hardware-level security for AI agents

Flexxon was named an awardee of Singapore's Cybersecurity Industry Call for Innovation (CyberCall) 2025 at the CyberSG Innovation Day on November 10, under the 'Cybersecurity for AI' challenge. CyberCall is organized by the CyberSG Talent, Innovation and Growth Collaboration Centre, a joint initiative of the National University of Singapore and the Cyber Security Agency of Singapore.

The funded project, X-PHY AI Armor, is a hardware-rooted secure Model Context Protocol gateway. It sits between an AI agent and the systems it reaches, inspecting every request for injected instructions and hijacked tools, and handing anything high-risk to hardware for enforcement.

The distinction from conventional API gateways is where the decision lives. Generic gateways inspect traffic at the network layer and can be reconfigured by anyone who controls the host. X-PHY anchors authorization for high-risk operations in the device and writes the audit record to hardware, so an attacker with host control cannot alter the decision or erase the trace.

Flexxon co-founder and CEO Camellia Chan framed the problem in terms of judgement: agents are useful precisely because they act without waiting for a person, which is also what makes them dangerous, and an agent following a malicious instruction looks no different from one doing its job. Her argument is that the check has to sit somewhere an attacker cannot reach.

This is Flexxon's third award under the same initiative. It was one of eight selected from 72 submissions in CyberCall 2019 for its X-PHY solid-state drive, and an awardee in the 2021 edition for a server security module. The earlier projects protected data at rest and the systems around it; AI Armor addresses a problem that barely existed when they were funded.

The threat model is now familiar but still under-addressed. Agents hold credentials, reach databases and APIs and act at machine speed, while the controls meant to supervise them run on the software layers an attacker is trying to take over. Instructions arrive as text and text can be poisoned: a single injected line in a document or another agent's reply can redirect behaviour while every action remains technically authorized.

What to watch: the project is still at development stage, so delivery, compatibility with the MCP ecosystem and pilots in high-value sectors such as finance, healthcare and government will matter more than the announcement. Hardware-anchored security also has to justify its cost and operational overhead, or it risks remaining a compliance story.