Cerberus wraps every tool executor, scores the whole session, and intercepts the call the moment privileged data, injection, and outbound intent correlate — before it fires. Self-hosted, inside your own VPC.
Give an agent access to your data and the open web and three things eventually line up in a single session: it reads something privileged, it ingests something untrusted, and it has a way to send data out. That combination — the Lethal Trifecta — is how prompt-injection turns into real data theft. Cerberus watches for exactly that correlation and stops the outbound call.
Every value entering the agent is tagged by trust: privileged store, user input, tool output, or untrusted web content.
Untrusted content is inspected for instructions that try to redirect the agent — the hijack attempt itself.
Outbound tool calls are scored for whether privileged data is about to leave to an attacker-influenced destination.
The durable ledger traces how tainted data spreads across shared agent memory, so a single poisoned write can be quarantined precisely — clean records and the audit trail stay intact. (Enterprise)
Watch Cerberus stop data exfiltration in real time across finance, healthcare, insurance, and government scenarios — with two lines of guard().
The detection engine, MIT-licensed. Wrap your executor with guard() or run the HTTP gateway. Works with LangChain, Vercel AI SDK, and OpenAI Agents.
Durable SQLite provenance ledger, blast-radius containment, egress/SSRF guard, policy tuning, and audit-ready evidence export. Runs entirely in your infrastructure — data never leaves your VPC. Deployed with our team.
Talk to Engineering ↗