Introduction

Milgram builds AI security on one detection engine, and offers it two ways.

nam-shub, the model

Milgram’s security model, purpose-built for AI safety. Send it a prompt, a document or an entire agent session, and it answers one structured verdict: whether something is wrong, how serious it is, what it is, and where it was found. Use it as an API, on your own infrastructure, inside your own product, and soon through OpenRouter.

The Milgram platform

An enterprise LLM firewall built on nam-shub. Route your AI clients and agents through it, and every request, response and tool call is inspected, recorded in sessions you can review, and held to your policies, with your own AI agents investigating over MCP.

nam-shub

nam-shub is a new model, trained from scratch for one job: telling you when something that passes through an AI system is an attack. It reads what you send it (a single message or a whole agent session, with its tool calls and reasoning) and answers with one verdict you can act on.

flowchart LR
  I[Prompt, document or agent session] --> N[nam-shub]:::accent
  N -- one verdict --> Y[Your application]
  Y -- what is safe --> L[Your LLM or agent]
  classDef accent stroke-width:1px

What it catches

nam-shub inspects every part of an AI exchange: system and user prompts, assistant replies, tool calls and their results, tool definitions, and the model’s reasoning when it is available. In all of them it finds:

• Jailbreaks and instruction overrides: attempts to make a model ignore its instructions or take on another role.
• System prompt extraction: attempts to make a model reveal its instructions.
• Indirect injections: instructions hidden in documents, web pages, emails or tool output, waiting for an agent to read them.
• Poisoned agent skills and instruction files: tool definitions and agent instructions that carry an attack.
• Tool and agent abuse: an agent about to run something it should not, such as exfiltrating data.
• Leaks: secrets, credentials and personal data where they should not be.
• Attacks across a session: multi-turn attacks, gradual escalation, and task or scope drift that look harmless one message at a time.

Every finding comes with a severity and, where they apply, its OWASP Top 10 for LLM applications and MITRE ATLAS references. See the response for the full verdict.

What makes it different

• It cannot be steered. Transformer-based models used as judges can be prompt-injected by the very text they are asked to judge (our research). nam-shub cannot be steered that way: it does not generate text or follow instructions, and only ever returns a verdict.
• Whole sessions, not single messages. It judges a conversation as a whole, combining signals across messages, so an attack spread over many turns is caught even when no single turn is.
• No truncation. A multi-megabyte agent session is scanned in full, never cut to fit a context window.
• Many languages. Attacks are detected across languages, not only in English.
• Fast and CPU-friendly. It runs on ordinary CPUs, in our cloud or in yours.
• Built for a low false-positive rate, so it can sit in front of every request without getting in the way.

What you can build with it

• Guard an LLM that has access to your data. Check every request before it reaches the model, and stop the ones that try to turn it against you.
• Screen third-party data. Check documents, web pages, emails and tool output for planted instructions before your agents read them.
• Watch your agents. Run nam-shub next to a self-hosted model and get a heads-up the moment an agent drifts out of scope or goes rogue.
• Power your own product. Integrate it into your LLM firewall or security product, or build a new security company on top of it.

Check a single message or an entire agent session: the API takes either, and answers the same way.

How to use it

API	Call nam-shub directly, in its own format or as an OpenAI-compatible chat completion. See the quick start. Needs a console account.
OpenRouter	Coming soon: call nam-shub through OpenRouter with the OpenRouter key you already have, no Milgram account needed, for a planned $0.02 per million input tokens.
On premises	Run nam-shub and the platform on your own infrastructure, CPU only, including air-gapped networks. Write to [email protected].
Milgram platform	Use nam-shub as the engine of a complete LLM firewall: the Milgram platform.

The Milgram platform

The platform puts nam-shub in the path of your AI traffic: an enterprise LLM firewall, a transparent proxy at the boundary where your AI traffic leaves your organization. Point a client at the Milgram proxy instead of the provider; Milgram forwards the traffic, scans it in both directions, and applies the action your policies set. Nothing about how your tools work changes.

flowchart LR
  C[AI clients and agents] -- requests --> P[Milgram proxy]:::accent
  P -- forwarded or refused --> M[Model providers]
  P -- verdicts and sessions --> K[Console]
  A[Your AI agent] -- MCP --> K
  classDef accent stroke-width:1px

• Works with the tools you already use. Claude Code, Codex, opencode, Gemini CLI, OpenRouter, and any application using the OpenAI or Anthropic SDKs: one base URL and one header. See the integration guides.
• Sessions, not just requests. Every conversation and agent run is recorded turn by turn, with its tool calls and results and the verdict of each part, for review in the console.
• Policies you control. Start in shadow to see what would be caught on your real traffic, then log, mask what must not leave, or block. Per key: give each team or tool its own.
• Investigation by your own AI. Connect your agent to the MCP server to triage detections, write incident reports and tune your policies, with your permissions and nothing more.
• Fewer tokens. Deterministic compression of the requests you send, to cut inference costs.
• Hosted or on premises. Use the hosted service, or run the platform on your own infrastructure, CPU only, including air-gapped networks.

See how the proxy works.

Access

Invite-only

The console at console.milgram.dev is in an invite-only beta: registration is closed, and accounts are created by invitation. To request access for your team, use the contact form.

The API with your own keys, the platform, its integrations and the MCP server all require a console account. Once the OpenRouter integration is live, anyone with an OpenRouter account can use nam-shub there, without a Milgram account. To hear when it is, write to [email protected].

Why “nam-shub”?

Nam-šub is an ancient Sumerian word for an incantation: a few words that make something happen. Sound familiar?

Next steps

Model quick startYour first verdict from nam-shub in one request.

nam-shub examplesFive attacks, from one prompt to an agent drifting across turns.

How the proxy worksRoute a client through the Milgram platform with one base URL and one header.

MCP serverLet your own AI agent investigate and review findings.