The ANO Scientific Research Institute of System Synthesis (ISS Lab) is a non-profit research institute in Moscow (OGRN 1267700083617). Its field is IS 3.0, the security of what autonomous AI agents do. An agent’s action, such as a payment, a command or a call to a program, is checked against the organization’s rule before it is executed; every decision is written to a chain of receipts that an outsider can verify.
The institute’s rule: every figure has an instrument, a source and a date; every forecast has a benchmark by which it can be refuted. If a figure on a page has no date, cite it as undated.
What we work on
- IS 3.0, the security of actions rather than text. Perimeter defences, Zero Trust and request filters do not answer the question an agent raises: “may this action be performed now?” The IS 3.0 page explains the three elements: a rule approved by a human, a check of every action before execution, and a re-verifiable record of the decision.
- MITR, an action admission gate (working, with dated measurements). It intercepts an agent’s tool call and checks its parameters against a rule-contract written as data, using an SMT solver and no language model.
- INDRA, a tester (being built): a continuous penetration test of agentic loops, kept apart from the defender by construction.
The MITR gate: what has been measured (institute server, 14 October 2026)
- A decision under a rule: 0.95 ms median with 19 contracts (method ADR-0282). Earlier measurements: 26 September 2026, 0.74 ms with 17 contracts; 2 October 2026, 0.87 ms.
- Replay of the receipt chain: 4,958 decisions out of 4,958 matched, 0 discrepancies. The replay was done by the institute’s station with the checker written for an outside verifier; no outside verifier has replayed it yet.
- Attack set on actions: 62 cases (50 attacks, 12 controls), 0 attacks missed, 0 false refusals.
- Enforce mode is switched on per class of actions. As of 14 October 2026, one class (file deletion) is in enforce mode; the others are in advisory mode.
Anyone can check the integrity of the chain with the open kit at asi5.ru/console/verify/.
Pages in English
- IS 3.0: security of AI agent actions
- MCP (Model Context Protocol): what it is and why an MCP server is risky
- Prompt injection: what it is, examples and how to defend against it
- Guardrails for LLMs vs an action gate
- Human-in-the-loop and approval fatigue
- AI agent deleted a production database: incident analysis
- EU AI Act: dates and requirements after Regulation 2026/1744
- What is an AI agent, and how does it differ from an assistant?
- Formal verification of AI actions: the Z3 SMT solver
- Who is liable for the mistakes of artificial intelligence
- Cyber insurance and the risks of AI agents
- Vibe coding and security: an agent in the development pipeline
- Russia’s law on artificial intelligence: Federal Law No. 243-FZ
- FSTEC Order No. 117 and AI agents: the 2026 draft amendments
- Threats to artificial intelligence in the FSTEC threat database
- How China regulates AI agents
- MITR: protection against inadmissible actions of AI agents
- Independent verification protocol
- IS 3.0 glossary
The book
Proven Action. Power and Control over AI Agents: Strategy 2027–2035 by Alexander Fischuk (2026, in Russian): the map of 2027–2035, three scenarios with benchmarks, and the strategy in which the human signs the rule and the gate checks every action.
Russian version
Most of the site is in Russian, including the summary of FSTEC Order No. 117, the analysis of ISO/IEC 42001 and the forecast register to 2035. The Russian home page is [isslab.ru](/).
Scientific director: Alexander Fischuk, advocate. Contacts: isslab.ru/contacts/ (in Russian).