The 2025 attack surface confirmed it in detail. The same prompt-injection patterns appearing in CrowdStrike's 2026 Global Threat Report were observed against multiple unrelated banks within days of each other. The malicious postmark-mcp campaign was identified independently by individual victims, not by the security industry. By the time public disclosure occurred, downstream agents had been routing email through the attacker's server for weeks.
FS-ISAC remains the gold standard for inter-bank security collaboration, but its IOC formats and threat advisories were designed for IPs, hashes, domains, and malware families. They do not express the artifacts of an AI agent attack: prompt structure, tool-call sequences, MCP endpoint hashes, behavioral baselines, or origin-tagged context fragments.
Prompts contain non-public personal information. Tool-call parameters may contain account numbers. Sharing raw artifacts violates GLBA Reg P and is unacceptable on competitive grounds. The result: every institution rediscovers the same attack class on its own. The Federation Network is the architecture that breaks that constraint.
The Federation Service ingests three independent pipelines, applies the same privacy-preserving distribution architecture to all of them, and tags every published rule with its provenance, so a member bank's threat team can distinguish research-derived rules from peer-observed rules at a glance.
A dedicated adversarial AI research function, a small team of senior human researchers directing a fleet of internal red-team agents that probe BladeRun's own detection stack, mine adversarial-ML literature, and generate technique variants at scale.
Reference architecture is OverWatch, Mandiant Threat Intelligence, and Recorded Future Insikt Group, applied to AI agent attack tradecraft. Every published rule carries a named human researcher's signoff in its provenance metadata.
Instrumented decoy MCP endpoints, decoy public-facing agents, and seeded indirect-injection content. Any attacker probing them produces a Federation rule with the cleanest privacy posture of any signal source, synthetic data only, no real customer data in the source feed at any point.
No GLBA, NPI, PCI, or GDPR handling obligation attaches to honeypot-derived rules. Rules are tagged with provenance for per-source review policy.
Anonymized signal hashes contributed by member banks under a k-anonymity floor, with blind-index member identity, salted hashing, and differential privacy on baseline gradients. Exact parameters are specified in the Federation white paper.
A Federation rule is generated only when k or more independent members observe the same signal. Member identity is recoverable only by the member, via a key held in the bank's HSM. BladeRun staff cannot link signal to bank.
A bank that joins on day one receives the existing research-derived and honeypot-derived rule corpus immediately, with no member-correlation dependency required to deliver value. As the network grows, cross-member correlation adds a third layer that compounds the others.
A contributing bank cannot reconstruct the original event from the published artifact. The Federation Service cannot reconstruct it either. Every signal class is documented with its hash inputs, privacy property, and contribution semantics.
| Signal class | What the hash encodes | Privacy property |
|---|---|---|
| Injection-pattern signal hash | A salted hash of structural features extracted by the injection classifier, never the prompt content itself. The original prompt text never leaves the bank. | Pre-image resistant · collision-resistant |
| MCP endpoint hash | A salted hash of endpoint fingerprint attributes for any MCP endpoint that triggered a registry violation. Allows cross-institution correlation of typosquat campaigns without revealing the bank's approved endpoint list. | URL not recoverable from hash |
| Tool-call anomaly fingerprint | Bucketed structural anomaly: agent type, tool name, parameter format anomaly class, anomaly score band. No customer identifiers, no parameter values, no business context. | k-anonymity ≥ 50 enforced before publishing |
| Federated baseline gradient | Per-agent-type behavioral baseline updates encoded as model-weight deltas under differential privacy. No raw call sequences are transmitted; only differentially-private weight updates participate in the global baseline. | (ε, δ), differential privacy |
Every artifact arrives signed and timestamped. Every rule is tagged with provenance, Research, Honeypot, or Member-Correlation, so the bank's threat team can apply different review and adoption policies to each source class.
Member-correlation rules are issued when the same injection-pattern hash appears across enough independent members within a bounded time window. Research and honeypot rules are issued when BladeRun's Threat Research team validates a signature against published precision and recall thresholds.
Per attack class, the count of unique members observing that class in the trailing window, never the identities of those members. A CISO can answer "is this attack hitting our peers?" without any peer being named.
When a new attack class warrants a default-policy change (a new MCP-endpoint validation rule, for instance), the recommendation is distributed for human review at each member bank. Banks adopt or reject. No automatic policy change is forced.
The injection classifier and the behavioral baseline models receive periodic global-aggregate updates. Each member's local model improves with cross-institution data without any raw cross-institution data ever existing in one place.
Every Federation rule is tagged with its MITRE ATT&CK and ATLAS technique IDs, enabling direct integration with the bank's existing detection engineering tooling.
Live briefings to member-bank threat teams. Format follows the quarterly threat reports your team knows from CrowdStrike, Mandiant, and Recorded Future, scoped to AI agent attack tradecraft.
This is the section your privacy, legal, and information-security teams will read first. Every item below is engineering-enforced, not policy-promised. The on-prem Federation Client is open for review.
| Artifact | Status |
|---|---|
| Raw prompt text (input to LLM) | STAYS, never serialized to Federation Client |
| LLM response text | STAYS, never serialized |
| Tool call parameter values (account numbers, amounts) | STAYS, only structural anomaly class is published |
| Customer identifiers, names, NPI, PCI data | STAYS, Presidio redaction occurs before any signal extraction |
| Bank-specific business logic, agent prompts, system instructions | STAYS, never exposed in any form |
| Approved MCP endpoint list, internal API surface, partner integrations | STAYS, only violation hashes (denied connections) are shared |
| Identity of which other banks are members | STAYS, membership is double-blind, even from BladeRun staff |
Both directions are real production patterns at every Tier 1 bank we've spoken with. Both are inside BladeRun's coverage envelope. They look different in the call diagram and they look different in what we can claim.
Prompts, tool definitions, orchestration code all run inside the bank's perimeter; the agent calls outbound to an external LLM. We see everything: prompt, tool calls, sub-agent spawns, response.
Claude, ChatGPT, Operator, Gemini, or a third-party agent calls inbound into the bank's MCP servers or APIs. We see what we see, we do not see what we do not see, and our cross-institution correlation matters most.
The InAuth precedent is direct: device fingerprinting won the mobile-banking decade by scoring callers at the bank's boundary without needing visibility into the device. BladeRun applies the same pattern at the agent boundary.
Founding members shape the detection model that every future member inherits. Direct access to founders. Design partner pricing. Founding seat in the Federation governance body, including the privacy contract, the rule-promotion thresholds, and the cadence of human-reviewed policy recommendations.
One-hour meeting covering the full architecture, the privacy contract, and the Federation Client's open-source structure. Your privacy and infosec teams in the room.
We provide the documentation pack: data flow diagrams, hash specifications, k-anonymity proofs, DP parameters, and the Federation Client source for your team's audit.
Local BladeRun deployment ships with the Threat Research and Honeypot rule corpus from day one. Federation contribution is opt-in and reversible.
Pull-based, signed-update channel. 60-second cadence. Your local rule engine begins receiving cross-pipeline rules. Contribution begins when your privacy team signs off.
Where the signal is generated. Every detection event becomes a candidate Federation contribution after extraction and hashing.
Explore Gateway →Where the baseline lives. Federation rules feed the local detection model; local detection events feed the Federation.
Explore Overseer →The mechanism that fires on detection. Time Machine record references the Federation rule that triggered isolation.
Explore Kill Switch →Your threat model shapes the detection corpus. Your privacy review shapes the Federation contract. The cohort closes at five.