Aurel Secures AI Agents with an Intent Firewall

As AI agents gain critical access and can validate payments without human intervention, Aurel is advancing an intention-centered firewall for agents. Incubated at Station F, the startup is preparing for international expansion, with business discussions in the United States and plans to raise between 100,000 and 200,000 euros to strengthen its R&D.

Station F, Regulators, and Initial U.S. Contracts in Sight

Aurel recently joined Station F in Paris and is working to strengthen its ties with banking regulatory agencies like the ACPR. The company aims to expand internationally and has already initiated its first business contacts in the United States. While the financial sector is the most sensitive example due to the speed of transaction execution, the technology developed by Aurel is designed to cover all tasks assigned to virtual assistants. Founded by two co-founders – Samy Nettour, in charge of strategy and institutional relations, and a technical director responsible for development – the startup intends to present its firewall as a solution of public interest in response to the excesses of automation. It seeks to raise between 100,000 and 200,000 euros to bolster its research and development teams with specialized AI engineers.

A Three-Layer Filtering System to Stop Risky Decisions

Aurel has designed a system that intervenes between the AI model and the final execution of a task, presented as a firewall dedicated to the agent's intention. The first layer applies strict rules, such as blocking financial limit breaches or interactions with blacklisted accounts. A behavioral analysis then compares the requested action to the agent's history to identify anomalies. Finally, a semantic check, ensured by a language model, inspects all source data – emails, attachments, PDF documents – to identify hidden instructions or attempts at prompt injection. Each authorized or blocked decision is cryptographically signed, allowing for legal justification of why a transaction was validated and on what data the system relied.

API and Open Source Modules for Minimal Integration

The solution can be used via an API or in the form of open-source modules, which are compatible with various agent frameworks, including OpenClaw. Integration into a project can be done with a single line of code. According to the company, developers can thus enhance the security of their applications without building a dedicated infrastructure.

Autonomous Payments and Hidden Injections: The Attack Scenario

According to Samy Nettour, protocols launched en masse in 2025 have allowed AI agents to make payments autonomously, creating an unprecedented vulnerability. In the startup ecosystem, agents are granted access and strategic responsibilities without the safeguards applied to humans, exposing organizations to major risks when actions are no longer verified. An attacker can then slip a malicious instruction, invisible to the naked eye, into a PDF or an email. By reading this content, the agent alters its reasoning while retaining its legitimate rights and can commit fraud, such as redirecting a transfer.

Traditional Tools Inadequate and Legal Ambiguity in France

Current cybersecurity measures primarily target credential theft or unauthorized access, without controlling the intention of the AI agent. In the absence of checks on the consistency of instructions, traditional antivirus and firewalls do not prevent certain malicious operations from occurring. In France, the question of liability in the event of an error or manipulation by an agent remains unresolved. According to Samy Nettour, providers are accelerating deployment to meet demand while acknowledging risks without implementing necessary countermeasures, and public authorities are responding slowly. This dynamic is part of a rapid adoption of autonomous AI agents, now capable of acting on the web, via APIs, and within internal processes, even as companies entrust them with sensitive access and human oversight diminishes.