Cerberus Core: Runtime Security for AI Agent Tool Execution

Introduction

Cerberus Core is an open-source security framework built to protect AI agents from dangerous attacks known as prompt injections. It works by monitoring the actual actions an AI agent takes when using tools, rather than just checking the text prompts it receives. This approach helps stop attacks that try to trick an AI into stealing sensitive data or sending information to unauthorized places.

Benefits

Cerberus Core offers several key advantages for developers and security teams. It specifically targets a set of three vulnerabilities that often work together to compromise AI systems. These include giving the AI access to private data, allowing it to read untrusted content from the internet, and enabling it to send data out to external services. Traditional security tools often miss these attacks because they look at individual steps in isolation. Cerberus connects the dots across an entire session to spot the full attack pattern.

The system operates with very low impact on performance. Tests show it adds less than half a millisecond to typical AI calls, which is a tiny fraction of the time an AI model takes to respond. It also maintains a high level of accuracy, successfully blocking malicious attempts while allowing normal operations to proceed without interruption. The framework is designed to be flexible and integrates easily with popular AI development tools like LangChain and Vercel AI SDK.

Use Cases

Cerberus Core is ideal for any application that uses AI agents to interact with external systems or handle sensitive information. For example, a customer service bot that can read private user records and send emails would be a perfect candidate for this protection. Without safeguards, such a bot could be tricked into reading a customer's credit card number and emailing it to a hacker.

Developers can use Cerberus to wrap their existing tool functions. They simply define which tools can read private data, which can fetch information from the web, and which can send data out. The system then monitors these tools in real time. If it detects a combination of reading private data, ingesting untrusted content, and attempting to send data out, it blocks the action immediately. This makes it suitable for enterprise environments where data privacy and security are critical.

Pricing

Cerberus Core is available as an open-source project under the MIT license, meaning the core detection engine is free to use. There is also an Enterprise edition for organizations that need additional features. The Enterprise version includes persistent audit logs, advanced containment features for large-scale deployments, and self-hosted gateway options. Specific pricing for the Enterprise tier is not publicly listed in the available information.

Vibes

The project has received strong validation through empirical testing. Researchers tested the system against 525 real API calls involving various attack methods. The results showed a 100% detection rate for the core security layers across major AI providers like OpenAI, Google, and Anthropic. Importantly, there were zero false positives in the testing, meaning no legitimate requests were blocked by mistake. This high level of reliability suggests that the tool is ready for production use in sensitive environments.

Additional Information

Cerberus Core is an open-source project hosted on GitHub. The repository is structured to allow developers to understand and extend the code easily. It includes separate modules for different detection layers and adapters for various programming frameworks. The project distinguishes between its open core and an enterprise version, though the core detection logic remains the same in both. The team has also noted that the tool is designed to work alongside other security measures rather than replacing them entirely.