Cerberus wraps every tool executor, scores the whole session, and intercepts the call the moment privileged data, injection, and outbound intent correlate — before it fires. Self-hosted, inside your own VPC.
Give an agent access to your data and the open web and three things eventually line up in a single session: it reads something privileged, it ingests something untrusted, and it has a way to send data out. That combination — the Lethal Trifecta — is how prompt-injection turns into real data theft. Cerberus watches for exactly that correlation and stops the outbound call.
Every value entering the agent is tagged by trust: privileged store, user input, tool output, or untrusted web content.
Untrusted content is inspected for instructions that try to redirect the agent — the hijack attempt itself.
Outbound tool calls are scored for whether privileged data is about to leave to an attacker-influenced destination.
The durable ledger traces how tainted data spreads across shared agent memory, so a single poisoned write can be quarantined precisely — clean records and the audit trail stay intact. (Enterprise)
Watch Cerberus stop data exfiltration in real time across finance, healthcare, insurance, and government scenarios — with two lines of guard().
A real run, shown from two angles: the operational pulse of a real gpt-4o-mini agent passing through guard(), and the read-only evidence surfaces that explain what the engine observed and contained.
Grafana operational overview from a live run window.
Tool-level activity and response types from the same window.
Prevention Ledger: proof-backed engine receipts.
Provenance and Containment: a read-only blast-radius view.
Posture and Oversight: coverage and audit evidence.
The Control Plane renders engine evidence for review; enforcement remains the engine's action. Grafana figures show one live run window, not lifetime or benchmark totals.
The detection engine, MIT-licensed. Wrap your executor with guard() or run the HTTP gateway. Works with LangChain, Vercel AI SDK, and OpenAI Agents.
Durable SQLite provenance ledger, blast-radius containment, egress/SSRF guard, policy tuning, and audit-ready evidence export. Runs entirely in your infrastructure — data never leaves your VPC. Deployed with our team.
Talk to Engineering ↗