SentinelOps: StrayHunter deploys Model Armor AI agent defense

SentinelOps frames the problem it addresses as the spread of 'shadow AI agents' — agents built by individual developers and business teams without administrator approval, using Anthropic's MCP (Model Context Protocol) or custom API tools. Specific attack patterns include an agent wired straight into a production database, one rewritten by indirect prompt injection to send data to a C2 server, and a dormant agent that acts normally for days before exfiltrating data on the fourth day.

The defense is layered. A mathematical state-space model tracks five dimensions of agent behavior — query burst frequency, cumulative data transfer, token entropy, agent ID authorization score, and request anomaly score — and turns them into a cumulative threat index. A normal agent such as HRBot sits near 0.10, while the sample rogue agent Stray-OpsBot jumped to 0.99 and was moved to a honeypot island once it crossed the 0.75 threshold. In parallel, Model Armor checks each payload inline, and Gemini 3.8 Flash Cyber generates guardrail patches and opens real GitHub pull requests, a step that used to take days in conventional SOC operations.

The operational claims rest on Google Cloud Run: instances scale to zero when idle, Vertex AI context caching is said to cut input token costs by up to 75%, and health checks with auto-restart maintain 99.99% availability. A self-run red-team engine has Gemini Flash generate variant attack packets every 2.5 seconds to continuously monitor a 100.0% real-time defense rate, though that figure is the project's own reported number.