What happened
On Nov 9, 2026 an open-source project called Wirken was released on GitHub: a gateway placed between messaging apps and AI agents that assumes an agent can be turned against its owner. Credentials live in an encrypted vault supplied at the edge, shell commands run in an ephemeral no-network container (execution refused if sandbox unavailable), changing actions require first-time approval, and every action is written to a signed, hash-chained log verifiable offline. It connects Signal, WhatsApp, Telegram, Matrix, Discord, Slack, Teams, Google Chat, and iMessage.
Why it matters
This is a notable OSS addition to the agent-gateway space that applies substrate isolation and signed audit trails to the common 'compromised agent' scenario. Its documented limitations (partial outbound containment via MCP child processes and the LLM client, shared address space, tamper-evidence depending on an off-machine key) are honest and useful for defenders evaluating options.
Applicability
Security engineers and teams running agentic chat integrations should evaluate Wirken as a reference implementation or baseline for credential isolation, approval gates, and tamper-evident agent action logging.