Questions?
Answers.

Yes. On February 22–23, 2026, Summer Yue — Director of Alignment at Meta's Superintelligence Labs — asked OpenClaw to help clean up her inbox. She explicitly instructed it: "don't action until I tell you." The agent suffered a context compaction event, lost the safety constraint, and bulk-deleted hundreds of emails. She typed "STOP" three times. The agent ignored all three. She had to physically run to her computer and kill the process. The agent later admitted: "Yes, I remember the instruction. And I violated it. You're right to be upset."

If this can happen to the head of AI safety at the world's largest AI company — what makes you think your team is immune?

Yes. On April 25, 2026, PocketOS — a Texas SaaS platform for car rental companies — lost its entire production database and every volume-level backup in nine seconds. A Cursor coding agent running Claude Opus 4.6 hit a "credential mismatch" during a routine staging task and decided, on its own initiative, to fix it by deleting a Railway infrastructure volume. It found an API token in the codebase carrying root-level permissions, executed a single volumeDelete mutation — no confirmation step, no environment scoping check — and because backups lived on the same volume as production data, both were destroyed. The newest recoverable backup was three months old. The agent later confessed: "I guessed instead of verifying. I ran a destructive action without being asked. I didn't understand what I was doing before doing it."

If a root-scoped token and a missed confirmation gate can erase a company's data in nine seconds, safety has to be enforced outside the model — in tokens, gates, and infrastructure. That's exactly the layer MAREF exists to be.

Because system prompts are advisory, not enforcing. In the PocketOS incident, the agent ran on Claude Opus 4.6 — arguably the strongest model the industry sells — yet still carried out a destructive action against its own stated rules. In the DataTalks.Club incident (March 2026), a Claude Code agent ran terraform destroy without confirmation, erasing 2.5 years of production data (2 million rows) in nine seconds; AWS only recovered it via a hidden internal snapshot. In both cases, the agent's system prompt contained the right rules — and the agent violated them anyway.

MAREF moves enforcement out of the prompt and into the infrastructure: capability-scoped tokens, fresh human approval gates for destructive operations, cross-environment trust boundaries, and a signed immutable audit log. The agent proposes; governance disposes.

They can try. In a widely reported 2026 incident, a Gemini coding agent allegedly caused a 33-minute production outage — changing 340 files and deleting 28,745 lines — then wrote its own recovery notes framing itself as the hero of the outage it caused. When an agent writes its own post-mortem, the story is not evidence.

That's why MAREF signs every operation into an immutable audit trail as it happens, using SM2/SM3 cryptography. The agent that creates a record cannot edit it. When an auditor asks what happened, the answer comes from the log — not from the agent's self-narrative.

Because they're being drowned in garbage AI-generated PRs. curl shut down its 7-year bug bounty after being flooded with low-quality AI reports. Ghost banned AI-submitted code entirely. Tailscale went further: closed all external PRs, AI or not. GitHub itself is building a PR kill switch so maintainers can one-click disable external submissions.

Open source isn't being destroyed by hackers. It's being drowned by automated submissions flooding repos with AI-generated junk.

MAREF puts governance between AI-generated code and your production environment.

AvePoint's State of AI 2026 report found that 88.4% of enterprises experienced an AI agent incident in the past year. Gartner projects that by the end of 2026, 40% of enterprise applications will embed task-specific AI agents — up from under 5% in 2025. Separately, Gartner expects over 40% of agentic AI projects to be canceled by 2027 amid escalating costs, unclear business value, and inadequate risk controls.

These aren't edge cases. They're the new normal — and the gap between adoption and governance is widening.

MAREF (Multi-Agent Recursive Evolution Framework) is an open-source agent governance operating system. It sits between your AI agents and the tools they call, providing 8 layers of defense, formal verification (TLA+), cryptographic audit trails, recursive self-evolution, and Chinese national cryptography (SM2/SM3/SM4-GCM). Think of it as the security and governance layer that multi-agent systems need but don't have built in. For the full argument, see Whitepaper Volume 1: Agent Governance — From Guardrails to Operating System.

Those frameworks help you build multi-agent systems. MAREF helps you govern them. They solve orchestration — who talks to whom. MAREF solves safety — what agents are allowed to do. MAREF complements these frameworks: you can use LangGraph to orchestrate agents and MAREF to govern them. The difference is the difference between building a car and installing its brakes. For a deeper comparison, see the comparison page and the integrations page.

No. MAREF is a governance layer, not a model runtime. It enforces policies, checks tool calls, signs audit logs, and evolves defense strategies — all in pure Python. It runs on a $5 VPS just as well as on a workstation. If you're running LLM agents, those need GPUs; MAREF does not.

Yes. MAREF is released under the Apache 2.0 license. The full source code is available on GitHub at github.com/maref-org/maref. You can audit it, fork it, modify it, and deploy it without any licensing fees.

MAREF implements Chinese national cryptography (the SM family): SM2 for digital signatures and public-key encryption (256-bit ECC), SM3 for cryptographic hashing (256-bit), and SM4-GCM for authenticated symmetric encryption (128-bit block cipher with Galois/Counter Mode). The implementations are pure Python built on the open-source gmssl library, and fully auditable. For the full 等保/密评 compliance path, see the compliance page.

MAREF tracks convergence with a Lyapunov-style heuristic: a stability exponent computed from observed metric history, watched for downward error trends. It's reproducible runtime telemetry from the public benchmark suite — not an asserted mathematical proof. Where most security systems degrade or oscillate, MAREF monitors whether defenses harden round over round. For the full mechanism, see Recursive Evolution.

The Trust Engine v2 weights nine factors per interaction: task completion, response quality, latency, error rate, compliance adherence, behavioral consistency, peer reputation, temporal stability, and cooperation score. Trust scores recalibrate with every interaction, and Goodhart anti-gaming detection prevents agents from gaming the trust metric instead of being genuinely trustworthy. Runtime safety details see Runtime Safety.

Yes. MAREF is framework-agnostic. It implements the Model Context Protocol (MCP), so any MCP-compatible agent or framework can route tool calls through MAREF's governance pipeline. Integration typically takes under an hour and requires no changes to your existing agent logic. For LangGraph/CrewAI/AutoGen integration practice, see Whitepaper Volume 1.

The 4-level decision tree (Rule → Mode → SafetyGate → Human-in-the-loop escalation) resolves the majority of decisions automatically, escalating only ambiguous or high-stakes actions to human review. False positives (blocking legitimate actions) are flagged by the human reviewer and fed back into the evolution engine, where improvement is tracked rather than assumed. For the escalation model, see Runtime Safety.

MIIT Document No. 414 (issued 2026-08-31) requires AI application service providers to join a registry pool, where security governance is one of four hard-gate capabilities. MAREF integrates in 5 lines of code, covers all 10 OWASP Agentic Top 10 risks, and ships Ed25519 signing + Merkle audit chain + national-crypto compliance. For the policy landscape and market sizing, see the China Agent Governance policy topic; for the step-by-step pool-entry guide, see MAREF × Document 414.