Skip to main content

Responsible AI adoption

Security that does not depend on the AI following the rules

An AI agent in Rhino can save hours of modeling work. But if you do not give the agent hard boundaries, it can also access your computer and leak your designs to the internet. Many companies are not ready for this: IBM found (opens in a new tab) that 97% of organizations with an AI-related breach lacked proper AI access controls.

We built NeoSpline for teams that care about safe and responsible AI adoption.

Our core principle is that NeoSpline never runs code that the AI writes itself (arbitrary code), such as Python or C#, on your computer. Instead, the NeoSpline agent gets a fixed set of operations, and nothing else.

See how this design maps to the two OWASP Top 10 lists for AI applications. OWASP is a nonprofit whose security guidance is widely used across the industry.

Two ways to put AI inside Rhino

  • Arbitrary AI code. The AI writes code, such as Python or C#, and it runs on your computer with the access that Rhino gives scripts: your files, the network, and other programs. Restrictions try to block the dangerous parts, but there are infinite ways around them.
  • NeoSpline. The agent can use only a fixed set of operations. NeoSpline's server checks every operation against a strict definition of what is allowed (a schema). The agent cannot take any action that we did not explicitly allow.

Python and C# in Rhino are great tools when a person writes the code. The risk starts when the AI writes the code.

The problem with letting the AI write anything and limiting it afterward is that you must close every path, and agents find the paths you miss, for example by using a command the rules do not cover (opens in a new tab). That is why OWASP advises against open-ended tools (opens in a new tab).

Arbitrary AI code

Allow all unless blocked
  1. You ask for a change.

In the cloud

  1. The AI writes Python or C# code.

On your computer

  1. Restrictions try to block the dangerous parts.
  2. The code runs.

NeoSpline

Deny all unless allowed and verified
  1. You ask for a change.

In the cloud

  1. The AI writes a NeoSpline script: a list of steps that use only allowed operations.
  2. NeoSpline checks every step against the fixed set of operations and rejects anything else.

On your computer

  1. Rhino runs only safe operations.

When the AI gets it wrong

An AI agent can take a harmful action for two reasons:

  1. Hidden instructions trick it: text in a file from a client, a consultant, or a vendor, or on a web page when the AI has internet access (OWASP LLM01:2026, p. 12 (opens in a new tab)). This is called prompt injection.
  2. It makes a plain mistake, with no attacker at all (OWASP LLM03:2026, p. 23 (opens in a new tab)).

No one can reliably prevent prompt injection today (opens in a new tab), so OWASP advises limiting the tools an agent can use and the inputs they accept (opens in a new tab). That is why the agent can use only operations that we added on purpose and checked. It has no operation for anything outside its intended use, such as file system access, internet access, or running arbitrary code.

How NeoSpline protects you when the AI gets it wrong
Hidden instructions or a mistake make the agent attempt a dangerous action.

No operation exists

  • Read a file
  • Open a web page
  • Run code
Nothing runs.

The operation exists

  • Delete objects
You see the action before it runs and can deny it.
If you approved it, Rhino's Undo (Ctrl+Z) restores the geometry.

By default, you approve each batch of changes before it runs. We do not treat this as a security boundary, because people who must approve every action soon stop reading closely. In an Anthropic study (opens in a new tab), testers caught a dangerous command only 13.6% of the time. This is also why AI-written code is not safe, even when a person reviews it before it runs. The fixed set of operations is the boundary.

The NeoSpline security boundary

An agent that can read your data and reach the internet can leak that data, for example by putting it into a web search request (Rall et al. (opens in a new tab), Willison (opens in a new tab)). In Rhino, the agent always reads your model, so it must have no way to send data out. An agent that can also read your file system can leak anything on your computer, such as passwords and access keys (Anthropic (opens in a new tab), Rehberger (opens in a new tab)).

Blocking access to some files is not enough. Agents reach blocked files through the command line, a search tool such as grep, or another programming language (Claude Code docs (opens in a new tab), Cursor forum (opens in a new tab), Zhong et al. (opens in a new tab)).

OWASP names three conditions for this kind of leak: access to private data, exposure to untrusted content, and a way to send data out. Removing any one of them removes the risk (opens in a new tab). The agent has no path to read or write other files, use the network, start other programs, run arbitrary code, or read the clipboard or environment variables. The NeoSpline plugin for Rhino, not the agent, uses files and the network for sign-in, logs, and support. This is normal application code that the agent cannot reach.

What the agent can reach

Through a fixed set of operations

Your open Rhino document
  • Files on your computerNo operation exists
  • The internetNo operation exists
  • Command line and other programsNo operation exists
The agent reaches your open document through its fixed set of operations. It has no operation for anything outside the box.

On request, we share more detail and our security documents under a non-disclosure agreement (NDA).

Request Security Documents

Found a vulnerability? See our Vulnerability Disclosure Policy.