How to build a secure, cross-protocol Agentic AI cluster in 15 minutes (without touching Istio).

Hopr.co built the Korvette-S Workload Security Proxy (WoSP) to secure Agentic AI clusters against lateral movement and prompt injection attacks. The solution uses Automated Moving Target Defense (AMTD) with MAID™ identities and SEE™ protocol to provide zero-trust at the transaction level, avoiding the overhead of traditional mTLS and service meshes like Istio. The Lane7 Agentic AI Blueprint demonstrates a 6-pod architecture that mixes protocols seamlessly while embedding moving target defense via Envoy sidecars and WebAssembly filters.

A ReAct loop is essentially an AI agent breaking down a complex problem by continuously "thinking" reasoning and "doing" acting . It queries an LLM, parses the output, calls an internal tool or API RAG database, calculator, external service , evaluates the result, and loops back. This creates a massive explosion of East-West API traffic. This traffic is ... Highly Chatty : Hundreds of micro-transactions per user prompt. Autonomous : The agent decides which internal APIs to call on the fly, making traffic patterns highly unpredictable. Latency Sensitive : Every millisecond of network overhead degrades the user's perception of the AI's speed. When Platform Engineers see East-West traffic, their first instinct is usually to throw a heavy service mesh like Istio and mutual TLS mTLS at the problem. However, in the context of Agentic AI, this introduces severe friction: The mTLS Overhead : Traditional mTLS relies on Public Key Infrastructure PKI and certificate rotation. Managing these certs across dynamically scaling AI microservices creates massive DevOps overhead. The Layered Blindspot : mTLS operates at Layer 4 the transport layer . It guarantees that Machine A is talking to Machine B, but it has no idea what they are saying. The Latency Tax : The handshake overhead of traditional cryptographic verification is punishing for rapid-fire ReAct loops. The Analogy : Think of an AI ReAct loop as a rapid-fire brainstorming session between a group of brilliant analysts. Using traditional mTLS is like forcing them to stop, pull out their driver's licenses, and have a notary stamp a document before they are allowed to speak their next sentence. The security mechanism destroys the velocity of the system. Are there incidents showing weaknesses? Absolutely. The OWASP Top 10 for LLMs specifically highlights Excessive Agency and Insecure Output Handling . If a threat actor successfully executes a Prompt Injection attack on an external-facing AI interface, that agent becomes a malicious insider. If your internal APIs are only protected by network boundaries or static API tokens, that compromised agent can move laterally, access sensitive RAG data, or execute destructive actions via your internal tools. Traditional Layer 3-5 defenses assume that if the traffic comes from the "trusted" AI agent pod, it must be legitimate. They are completely blind to a hijacked reasoning loop. This is exactly why we built the Korvette-S Workload Security Proxy WoSP at Hopr.co. Instead of relying on static certificates and heavy network-layer meshes, we use an Automated Moving Target Defense AMTD . Here is how I break it down for our peers: Zero Trust at the Transaction Level : We use MAID™ Machine Alias IDentity to provide cryptographic, rotating identities for workloads. We don't just trust the IP or the static cert; we verify the identity for each transaction. Defeating Lateral Movement : Using the SEE™ Synchronous Ephemeral Encryption protocol , our sidecars establish mutual authentication and rotate keys instantly. If an AI agent goes rogue, it cannot reuse intercepted credentials or static API keys to exploit downstream services. Invisible to the Application : We deploy this using an Envoy sidecar architecture with a WebAssembly Wasm filter. For example, our Lane7 blueprints demonstrate injecting the xtra-wasm-filter directly into the Envoy configuration without requiring any changes to the underlying application code. Codes Hidden In Plain Sight CHIPS™ : We embed moving target defense directly into the payload at layer 7 or layer 4. When you look at the Lane7 Agentic AI Blueprint , it is a masterclass in decoupling the application layer's protocol complexity from the underlying Zero Trust security model. Here is a breakdown of how this 6-pod architecture operates and how it pulls off that seamless protocol mixing: The blueprint lays out a classic scatter-gather fan-out/fan-in ReAct pipeline, but hardens it with Hopr's Automated Moving Target Defense AMTD across every internal hop. The message flow moves cleanly through the stages: The Entry/Routing Phase : Traffic hits the ai-gateway the boundary entry , which validates the payload and passes it to the ai-orchestrator . The orchestrator acts as an MCP-style task dispatcher, broadcasting the task out to two concurrent processing branches. The Inference/Action Phase : The payload is processed simultaneously by the llm-gateway which handles the LLM inference SDK calls and the tool-executor which dispatches agentic tools like web searches or DB lookups . The Aggregation/Exit Phase : The nlp-processor acts as a fan-in aggregator, waiting for both the LLM and tool branches to finish before merging the results. Finally, it ships the unified payload to the ai-results-sink , which serves as the boundary exit. What makes this blueprint brilliant from a networking perspective is how it handles the reality of modern AI workloads: not everything should be stateless HTTP. The architecture intentionally uses heterogeneous protocols across the pod boundaries. It splits the protocols based on the specific needs of the AI pipeline leg: HTTP for Boundaries and State Routing : Standard HTTP is used for the ai-gateway , ai-orchestrator , nlp-processor , and ai-results-sink . This makes perfect sense for boundary entry, fan-out dispatch, fan-in aggregation, and boundary exit where standard request/response framing is optimal. WebSocket for Streaming Inference Legs : The blueprint switches to persistent WebSocket sessions for the llm-gateway and tool-executor . In production, LLM inference and agentic tool-calls require real-time streaming responses, making persistent WebSocket connections the right tool for the job. YAML schema version: "2.0" network: id: "agentic-ai" name: "Agentic AI Blueprint — 6-Pod Zero Trust" deployment scope: "single-cluster" protocol: http network default pods: - id: "ai-gateway" template: "http-gateway" - id: "ai-orchestrator" template: "ai-orchestrator" - id: "llm-gateway" template: "llm-gateway" protocol: websocket override for streaming LLM leg - id: "tool-executor" template: "tool-executor" protocol: websocket override for real-time tool feedback - id: "nlp-processor" template: "nlp-processor" - id: "ai-results-sink" template: "http-sink" connections: - from: ai-gateway to: ai-orchestrator - from: ai-orchestrator to: llm-gateway - from: ai-orchestrator to: tool-executor - from: llm-gateway to: nlp-processor - from: tool-executor to: nlp-processor - from: nlp-processor to: ai-results-sink Usually, mixing HTTP and WebSockets inside a service mesh requires complex, brittle L7 routing rules. The Lane7 blueprint handles this seamlessly by dropping the security down to Layer 4. Here is what is happening under the hood: Pure L4 Tunneling : In the Envoy configuration, the Hopr xtra4.wasm filter sits right before envoy.tcp proxy . This forms a pure Layer 4 persistent TCP tunnel. Protocol Transparency : Because the security the CHIPS™ payload embedding, SEE™ encryption, and MAID™ rotation happens at the TCP byte stream level, the protocol framing is entirely transparent. HTTP framing, WebSocket frames, and gRPC HTTP/2 frames all pass through the security layer identically. Smart Egress Configuration : The egress Envoy listener on the sending pod is automatically configured to speak whatever ingress protocol the receiving pod expects. As DevOps engineers, we know that trying to force streaming LLM inference through a rigid HTTP request/response cycle introduces massive latency and timeout headaches. By utilizing an L4 TCP proxy with a 300-second idle timeout, this architecture keeps the WoSP tunnels alive, lets the application code talk natively to localhost using whichever protocol fits best, and keeps the whole cluster secured by default. Let's talk about the elephant in the room for AI infrastructure: Prompt Injection via network interception. Most of the industry talks about Prompt Injection as an external, front-door problem—a user typing a malicious prompt into a chat UI. But as Platform Engineers, we have to operate under the assumption of breach. If a threat actor compromises a low-tier service in your cluster, they will attempt to move laterally by sniffing East-West traffic. In a traditional service mesh protected by static API tokens or long-lived mTLS certificates, an attacker can simply intercept a valid credential, replay it, and inject a malicious prompt directly into your internal llm-gateway or tool-executor . Suddenly, the attacker has autonomous control over your internal agents. Here is how the Lane7 Agentic AI architecture completely breaks that kill chain. Defeating Network-Level Prompt Injection with AMTD The 6-pod blueprint uses Hopr's Automated Moving Target Defense AMTD to secure all inter-pod communication. Instead of relying on static identities, the AMTD engine rotates cryptographic identities very frequently configurable . Think about what this does to an attacker's window of opportunity: The Interception : An attacker manages to sniff the raw TCP stream between the ai-orchestrator and the llm-gateway . The Extraction : They extract the session identity or credential. The Pivot : They attempt to craft a malicious Prompt Injection payload and replay the hijacked credential. The Block : Because the cryptographic identities rotate very often, the intercepted credential becomes completely useless almost instantly. The Hopr WoSP immediately drops the forged request. By constantly shifting the attack surface at Layer 7, we strip the attacker of the time required to weaponize intercepted credentials. While the Cloud Native AMTD security model is incredibly powerful, if I am being honest with you as a fellow DevOps engineer, the primary reason we build Lane7 blueprints isn't just security. It is about developer velocity and operational simplicity . Building a Zero Trust application network from scratch usually requires a massive administrative tax. You have to stand up a Certificate Authority CA , manage complex Public Key Infrastructure PKI , and write thousands of lines of brittle YAML for Istio virtual services and sidecar injections. The Lane7 blueprints completely eliminate this overhead. Here is why this matters for your CI/CD pipelines: No PKI Overhead : This blueprint implements a Zero Trust pipeline where no certificates, CAs, or PKI of any kind are required. Application Code Stays Clean : Developers write their code to talk natively to localhost. The WoSP sidecar handles all the secure transport and cross-cluster routing transparently, meaning no application code changes are required to achieve Zero Trust. Instant Deployment : The blueprint gives you a pre-validated "steel frame." You simply inject your custom LLM logic into the app.py stubs, build the images, and run a single bash deploy.sh script to spin up the entire 6-pod architecture. And here are the steps to get started. Select and download a Lane7 Blueprint for free from our Blueprint Catalog https://www.hopr.co/lane7-blueprints L7-catalog In a few minutes you will receive a Blueprint .zip bundle and a 30-day Free trial license Unzip the bundle and follow the README Your license and credentials are in the 02-secrets.yaml for each pod Your Kubernetes manifests are pre-configured – no additional config is needed Create a cluster or use an existing one in a local Kubernetes environment Create Docker images for each app.py Dockerfile included in the blueprint in each pod and insert the images in the cluster s . Deploy the app network with one command deploy.sh Monitor the pod deployments per the README Customize the application in each pod. We made it easy to add your own business logic. Edit Section 1 only. An average DevOps can complete the deployment in about 15 minutes. We designed these blueprints because Platform Engineering teams shouldn't have to choose between shipping fast and staying secure. And by baking AMTD into a deployable template, you can accelerate the rollout of complex, multi-agent AI networks while simultaneously immunizing them against lateral movement and network-level prompt injection. By shifting to AMTD at the application/pod, we strip away the massive DevOps overhead of managing complex PKI and heavy service mesh configurations. We give the AI the low-latency communication it needs to execute ReAct loops efficiently, while ensuring that even if an agent is compromised, the blast radius is contained to a cryptographic zero. It's about enabling velocity for developers without compromising on Zero Trust. Let me know if you want to dive deeper into how we structure the Envoy filters or the SEE™ protocol You have two options: The Fast Track : Download the pre-configured Agentic AI Blueprint directly from our catalog https://www.hopr.co/lane7-blueprints L7-catalog . You'll get the Kubernetes manifests, a 30-day trial license, and the deploy scripts. Spin it up in 15 minutes. Author's note : The security of our technologies has been classified as EAR and is subject to US export controls. Just wanted to be upfront about that for this community The Custom Track : Have a unique use case? Contact us to discuss your use case, and we will construct the topology.yaml and run it through our internal lane7-compose engine and hand you a fully secured, bespoke Kubernetes blueprint for free. Don't waste days configuring service meshes. What is you experience with building an Agentic AI app? How concerned are you with it's security? How much time do you spend with connection routing, policies, and access control? Please share your thoughts