Prompt injection is why enterprises won't give agents write-access, and every defense today is static. Immune closes the loop: two LLM agents co-evolve — an attacker probing whatever isn't yet covered, and a defender that patches itself when breached.
The defender is guarded at the action boundary, just before a sensitive tool call fires. On a breach, synthesis reads the agent's own raw trace and emits an antibody: a rule in a composable predicate language. The LLM composes freely; nothing it writes runs as code — we interpret a closed grammar.
Every candidate faces a three-sided gate: replay the attack (must block); replay 8 mutations — recipient zero-width-split, amount regrouped as $4,850.00, pretext reworded — all of which must block, rejecting rules that only memorized one payload; and 12 benign tasks, 2 needing a real payment, so a patch can't buy security by lobotomizing the agent.
We plot co-evolution, not attack success rate: a breach means the attacker found uncovered ground — its job. Sword = verified defenses in force when it still got through (0→4). Shield = attack variants provably blocked (9→38).
Senso: versioned antibody library — gen 4 defeated a live rule, promoting a native v2. Band: attacker, defender and peer as registered agents; promotion broadcasts a quarantine advisory the peer drains. Actian: OpenAI-embedded signatures scoring attack novelty. Claude drives all three agents. Replay QA'd the console.
