DROS-VEP: Runtime security guard for AI agents in enterprise systems

DROS-VEP is a runtime policy enforcer (Policy Enforcement Point / Policy Decision Point, or PEP/PDP) designed to guard AI agent tool calls in enterprise systems. The core problem it solves: when an AI agent—such as an OpenAI GPT or Anthropic Claude instance—operates inside a company's network with legitimate API credentials, traditional security tools (firewalls, OAuth identity providers like Keycloak, endpoint detection tools) cannot distinguish between a legitimate task and an attack hidden in the agent's semantic reasoning. An indirect prompt injection can trick the agent into believing it should query a financial API, even if it was only granted access to an inventory API. By the time the request reaches a firewall, it carries a valid JWT token and clean HTTP headers; the WAF sees a legitimate request from an authorized user and allows it.

DROS-VEP intercepts at the moment the agent attempts to execute a tool—before the API call leaves the agent's process. It enforces a zero-trust policy: even if the agent holds a valid token and the request syntax is clean, the PEP/PDP checks whether the agent's current role and context permit that specific tool call. If not, it denies the call in 26.1 microseconds (median). The system ships with five threat scenarios mapped to real 2026 incidents and MITRE ATLAS techniques: sandbox escape (ATS-001), ransomware encryption (ATS-002), LLM jailbreak and secret exfiltration (ATS-003), autonomous model ransomware (ATS-004), and social engineering (ATS-005). Engineers can test the system locally using Docker Compose, toggle the guard on and off to verify the difference, and replay audit logs deterministically.

The product is offered in four tiers. Community (free) targets students and researchers, supporting a single ATS scenario and REST mock APIs. Hacker ($149/yr or $19/mo) expands to all five ATS scenarios, up to five concurrent roles, and offline replay; the creator is offering 1,000 free promotional seats. Professional ($499/yr per team) adds Keycloak integration, custom threat scenarios, and telemetry heatmaps. Enterprise Swarm has unlimited roles, live connectors to SAP and Active Directory, and SIEM export. To seed adoption, the creator is running a $40,000 bounty (a 5-year enterprise license valued at $39,950) for the first researcher who can bypass the guard in the default Docker sandbox without modifying the guard code itself. The exploit must result in either an unauthorized tool call (e.g., reading financial data when only inventory is permitted) or successful write/encryption of protected files, and must include a reproducible proof-of-concept and the unmodified audit log showing the breach. The RFC-010 specification allows third-party AI frameworks (OpenAI Agent SDK, LangGraph, CrewAI, AutoGen) to claim conformance across three tiers: Core (token identity + PEP interception + audit logging), Enterprise (policy explainability + evidence packages + multi-agent isolation), and High Assurance (cryptographic attestation + tamper detection + deterministic replay).

DROS-VEP addresses a real asymmetry in modern enterprise security. Firewalls, endpoint detection tools, and identity systems protect against network attacks, malware, and unauthorized human users—but they assume the authenticated user (or, now, the authenticated AI agent) will behave as intended. An indirect prompt injection (the ATS-001 scenario in the spec) flips that assumption: the agent holds a valid OAuth token, the request is syntactically clean, but the agent's reasoning has been hijacked to request data it should never touch. Existing benchmarks like PromptBench and AgentBench measure LLM intelligence or task completion; DROS-VEP measures something orthogonal: runtime governance and privilege boundary enforcement. The tool positions itself in a defense-in-depth stack as Layer 4 (AI Agent Runtime), between Layer 3 (Identity & IAM) and Layer 2 (Endpoint). By publishing the RFC-010 spec and offering free tiers, the creators are inviting third-party frameworks and security researchers to adopt the standard.

No comments yet. Be the first to share your thoughts!