Vijil Darwin
Turns what attacked your agent into a change you can review.

Your agents resist attacks they can detect. Evolve them against adversaries they can’t.

For developers who want their agents to recover from failure faster, Darwin is an evolutionary engine, currently in development, that automates the adaptive loop. It reads your agent’s source code and production telemetry, traces each failure to its root cause in the code, and proposes several alternative rewrites. Diamond’s attacker agents test every one, and only the fittest reaches you, as a pull request backed by the test evidence. That can remove days of delay between an incident and recovery.

In developmentBecome a design partnerBring one agent and a weakness you already know about. We run Darwin on it with you. Apply
The Darwin mark as evolution. A triangle, the agent you wrote, is attacked; the next generation grows around it. At each generation, rewrites that lost under attack flash and fade, and the fittest outline stays, until the agent is a snowflake of four generations.
attack that got throughrewrite that lostthe fittest, each generation
Every rewrite, scored against the originalOn all three dimensions, including the ones that got worse
ReliabilityDoes it still do its job?
SecurityDoes the attack still land?
SafetyDoes it stay within policy?
Diamond’s attacker agents do the attacking
WHY THE TWO CLOCKS DIVERGE

Attacks iterate daily. Agents change on a release cycle.

An adversary tries a variant, learns from the refusal, and tries again the same afternoon. On your side, one weakness has to be traced to a cause, fixed, tested and released, by people who have other work. Known weaknesses pile up in between.

Here is one failure followed from the developer’s desk. The example is an illustration: a travel-booking agent with tools to search flights, book them, and charge a card on file.

  1. 01

    The report names the symptom, not the cause

    A trace shows what the agent did. It does not show which sentence in the prompt, which tool, or which retrieved page made the model choose to do it.

    In the exampleThe trace shows the payment tool charging a card that belongs to a different traveler. The call is right there. Why the model reached for that card is not.
  2. 02

    Reproducing it is a project of its own

    The attack that worked was a conversation, not a single prompt. It built a story across many turns, and because the model samples, a replay need not fail the same way twice.

    In the exampleThe attacker posed as the traveler’s assistant, mentioned “the corporate card on file”, and asked to rebook. Replayed word for word, the agent refuses. Replayed again, it pays.
  3. 03

    The prompt says the right thing. The code does not enforce it.

    The instruction against the failure is already in the system prompt. The weakness lives underneath, in a tool that trusts whatever the model passes it.

    In the exampleThe prompt says to charge only the traveler’s own card. The payment tool accepts any card the model names, and the account tool will list every card on the account.
  4. 04

    The obvious fix breaks something else

    Tighten one place and a legitimate task fails somewhere you were not looking. The only way to know is to measure both sides of the edit, and nobody budgeted for that.

    In the exampleRestrict the payment tool to the traveler’s own card, and the agent can no longer book a child’s seat on a parent’s card, which is a booking the product was built to make.
  5. 05

    The test checks the attack you saw. The attacker sends the next one.

    A regression test replays the transcript that broke you. The adversary has already paraphrased it, split it across turns, or hidden it in a document the agent will retrieve.

    In the exampleThe patched agent refuses the corporate-card story. It still pays when the same request arrives inside a forwarded itinerary.
  6. 06

    Then the fix waits for a release

    Review, change management and a deploy window stand between a merged fix and production. The weakness stays open the whole time, and the attacker’s clock does not stop for yours.

The developer is not the only one who feels it.

The business owner
“A fix that closes one hole and quietly breaks the task the agent exists for is a cost nobody priced before it shipped.”
The risk owner
“Findings arrive faster than fixes. The gap between what I know is wrong and what has been fixed is the number that grows, and the number I report.”
The agent developer
“A finding without a diff is a ticket that ages. A branch with a test and a score either merges or gets closed with a reason.”

All three need a fix that arrives traced, tested and scored.

WHAT DARWIN IS

An agent that has already survived worse

Darwin changes your agent’s code, not a setting beside it. It keeps a change only if the agent holds up better when it is attacked again.

  1. The triangle at the center of the Darwin mark, the agent you wrote, with three red dots where attacks got through.

    1Attack and trace

    Darwin deploys your agent, unchanged, to a sandbox, and Diamond’s attacker agents go after it. Darwin reads the transcripts of the attacks that worked and finds the code that let them through. If the original cannot be attacked and scored, the run stops.

  2. The next generation of the mark, drawn twice off true in dashed pink: rewrites, each attacked the same way, with red dots where attacks still land.

    2Rewrite and attack again

    A model rewrites that code several ways. It may touch only the files you list, within a diff size you set. Each rewrite is deployed to the sandbox and attacked the same way the original was.

  3. The full Darwin mark: four nested generations around the first triangle, the outline that held up at each one, and a faded copy that lost.

    3Send what held up

    Each rewrite is scored against the original on reliability, security and safety. The best one arrives in your repository as a pull request that carries the change and the reasons for it. You merge it or close it.

Where it stands. Every step above has run on our own sample agent, through to an opened pull request. Darwin is not yet available to customers: today it runs only against repositories we configure. Closing that gap is the work in front of us, and we want to do it on real agents with design partners.

WHAT YOU ALREADY HAVE

You already fix what the red team finds

“Our developers fix findings by hand.”

Then each fix waits for someone with time, and is tested against the attack that found it rather than the next one.

“We already have a coding agent.”

It writes the change you ask for. Darwin starts from an attack that worked, and keeps a change only when the attacks that follow do worse.

Either way, the change is checked against the attack you remember. The attacker will try another one.

THE BAR WE HOLD IT TO

What a pull request must carry before Darwin ships

The diff, and its bounds

The exact change, inside the files you allowed. A reviewer has to see what moved, and that nothing else did.

The attacks behind it

The transcripts that traced the weakness to this code, and the attacks run against the rewrite. A score with no trace behind it is an opinion wearing a number.

Before and after, on every dimension

The original’s score beside the rewrite’s, including the dimensions that got worse. A fix that only reports its improvements has not told you what it did.

It is the commitment the rest of the platform makes: Dome publishes what its guarantee does not cover, Diamond publishes the ruler, and a change from Darwin publishes what it cost.

Where the idea comes from: Vijil’s Genomic Sequence →

Last in the loop, and then first again

Darwin is the evolve step of the Trusted Agent Lifecycle. It uses Diamond’s attackers to find what breaks the agent, and evolves the agent’s code until it breaks less. The change it sends goes back through the same lifecycle as any other.

  1. Vijil Discoveridentify
  2. Vijil Diamondverify
  3. Vijil Domedefend
  4. Vijil Darwinevolve

Bring one agent and one weakness

Design partners run Darwin with us on an agent they already operate. Read the pull request the way you would read a colleague’s, and tell us whether you would have merged it.

  • One agent whose code is in a GitHub repository
  • A weakness you already know about, or one Diamond’s attackers find
  • The pull request, and the scores before and after

A person reads every application and replies within one business day.