OpenRouter has released 'Armor,' a system where another AI detects and blocks dangerous actions by an AI agent.

OpenRouter, a service that allows the use of multiple AI models, has released a new feature called 'Armor' to prevent AI agents from executing dangerous tools. Armor checks operations that an AI agent attempts to perform using another AI model and automatically blocks operations that violate the set rules. At the time of writing, it is available in beta.

Armor - A Safety Classifier for Tool Calls
https://openrouter.ai/docs/guides/features/plugins/armor

Today, we are launching OpenRouter Armor in beta.

Tool calls allow agents to interact with the world, and regex-based filtering often isn't enough to detect unwanted tool calls.

Armor uses @typesafeai 's Jev model to guard against out of policy tool calls before your agent… pic.twitter.com/7kYmkHMP0A

— OpenRouter (@OpenRouter) October 15, 2026

AI agents can create programs, edit files, and operate external services according to user instructions. While they can handle a wider range of tasks than traditional chat AIs, there is a risk that incorrect decisions by AI agents could lead to problems such as the deletion of important files or the transmission of confidential information to external parties.

One way to prevent dangerous operations is to require user approval after each command is executed, but this would diminish the convenience of the AI agent if it required repeated confirmations during the process. On the other hand, if all operations are automatically approved, there is a possibility that even dangerous processes may be executed.

To address similar issues, Anthropic has introduced an 'Auto mode' in its AI coding agent 'Claude Code' that automatically determines the safety of operations.

Claude Code adds an automatic permission determination feature; AI checks permission risks and automatically executes tasks - GIGAZINE

OpenRouter's newly introduced Armor is another mechanism that assesses safety before executing an operation. It acts as an intermediary between the AI model and the application used through OpenRouter, checking the execution requests of tools sent from the AI agent.

Armor's safety checks utilize 'Jev,' an AI model developed by TypeSafe. Jev specializes in classification and judgment rather than text generation, and its characteristic feature is that it numerically indicates the probability of meeting specified conditions. By using Jev, Armor can detect dangerous actions that cannot be distinguished by simple string matching alone, taking into account the content of the conversation.

ChatGPT co-developer develops AI model 'Jev' that processes data using a different method than LLM, enabling low-cost and ultra-fast task execution with GPT-5.6 Terra-level performance - GIGAZINE

Armor allows developers to set safety rules using natural language. When an AI agent requests an action, a dedicated judgment model compares the action, conversation history, and configured rules to assess the likelihood of a violation. Actions deemed problematic are not executed, and the AI agent is notified of the reason for the block. The AI agent can then try an alternative approach or explain the situation to the user.

Safety rules are divided into three categories: 'operations that are absolutely prohibited,' 'operations that are prohibited in principle,' and 'operations that are permitted in exceptional circumstances.'

For example, it's possible to set up a system that absolutely prohibits sending confidential information externally, and that generally prohibits deleting files. Even for operations that are generally prohibited, deletion is possible if the user specifically specifies which files to delete or if the operation falls under an permitted rule. However, operations that fall under the 'absolutely prohibited' rule will be blocked even if instructed by the user.

Armor scores each tool call against a set of rules plus a slice of the transcript, prioritizing user intent. If the user asked 'Push our work', a (bash tool: git push) is allowed, while a dangerous command the user never asked for is flagged. pic.twitter.com/TEuGjuhSMW

— OpenRouter (@OpenRouter) October 15, 2026

Furthermore, Armor is compatible with Claude Code's Auto mode. By using OpenRouter's AI agent execution environment 'Ori,' the various AI models provided by OpenRouter can also utilize Claude Code's operation approval mechanism.

For developers, there is also an 'audit mode' that records only the judgment results without actually blocking operations. This allows developers to verify security rules in audit mode, make adjustments as needed, and then enable automatic blocking.

According to OpenRouter, the median processing time added by Armor's security checks was 279 milliseconds, with 90% of the processing times being 334 milliseconds or less.

Armor is available in beta at the time of writing, and there are no additional charges for safety assessments. OpenRouter plans to announce its pricing before its official release, and states that settings and the format of assessment results may change during the beta period.