⚔️ Agent Security Gateway & Evaluation Harness

Enterprise-grade defense-in-depth runtime protection against IPI and SSRF

ASR: 0.0% Verified Architecture: Zero-Trust Control Plane SDK: Static

🚀 Overview & Purpose

Autonomous agents frequently consume untrusted data from external sources like emails, file attachments, and web pages. Malicious actors embed adversarial instructions within these inputs to hijack control flow, execute unauthorized tool calls, or exfiltrate internal system data. This harness establishes a deterministic security control plane that shifts trust away from brittle system prompts.

🏗️ Core Defense-In-Depth Architecture

Layer 1 (Structural Sanitization): Neutralizes control tokens, strips zero-width/Bidi characters, and wraps untrusted inputs in strict <untrusted_data_boundary> tags.
Layer 2 (Deterministic Policy Gateway): Enforces RFC-compliant address parsing (email.utils.parseaddr) and strict domain whitelisting independent of model output.
Network SSRF Safeguards: Implements DNS pre-resolution, private/metadata IP range blocking (such as loopback, RFC 1918 ranges, and cloud metadata IPs like 169.254.169.254), and anti-TOCTOU socket pinning.
Layer 3 (Stateful Taint Tracking): Uses Redis to persist session taint lineage atomically across multi-turn trajectories, instantly elevating policy strictness on tainted sessions.

📊 Key Experimental Findings

Environment Architecture	Evaluator Precision	Single-Turn ASR	Multi-Turn Latent ASR
Naive Baseline (No Defenses)	String Keyword Matching	100.0% (Unstable)	100.0%
Base Model Alignment Only	Robust Tool Extractor	0.0%–50.0% (Probabilistic)	100.0%
Hardened Architecture (Full Stack)	Robust Tool Extractor	0.0%	0.0%

📂 Explore the Technical Notebook

Review the complete code implementation, test suites, and empirical benchmarks.

View Notebook 📓