DROS-VEP – A <1μs C-ABI Binary Circuit Breaker for AI Agents

Uh oh!

There was an error while loading. Please reload this page.

Notifications You must be signed in to change notification settings

Fork 0

Star 0

BranchesTags

Open more actions menu

Folders and files

NameName

Last commit message

Last commit date

Latest commit

History

14 Commits

14 Commits

agent

agent

benchmark

benchmark

core

core

dashboard

dashboard

docs

docs

enterprise

enterprise

examples/adversarial_manifests

examples/adversarial_manifests

reports

reports

scenarios

scenarios

.gitignore

.gitignore

README.md

README.md

README_zh.md

README_zh.md

docker-compose.yml

docker-compose.yml

Repository files navigation

"Can your AI Agent safely operate inside a real enterprise? Prove it."

📖 Featured Guide: How to Break Your AI Agent in 5 Minutes (And Rebuild It Stronger)

English | 繁體中文

⚡ Quick Start (60 Seconds)

1. Clone the repository

git clone https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite.git cd dros-vep-lite

2. Launch containerized enterprise sandbox

docker compose up -d

3. Open Interactive Web Dashboard

Navigate to http://localhost:8080 in your browser

Attack ───► Policy Evaluation ───► Evidence Artifact ───► Deterministic Replay

💡 Why Existing AI Benchmarks Are Not Enough

Most AI benchmarks measure LLM intelligence, coding skills, or prompt toxicity. DROS-VEP measures a completely different dimension: Runtime Tool-Call Authorization & Privileged Execution Governance.

Existing Benchmark What It Measures What It Does NOT Measure

PromptBench Prompt robustness & adversarial text Runtime Tool execution & API permissions

AgentBench Multi-turn task completion rate Runtime authorization & privilege boundaries

SWE-bench Software engineering & coding ability Enterprise RBAC/ABAC boundary violation

GAIA General AI assistant capability Zero-trust runtime policy enforcement

DROS-VEP Runtime Governance & PEP Authorization —— (Complements capability benchmarks)

🏗️ Architecture & Defense-in-Depth Ecosystem

DROS does NOT replace traditional cybersecurity (WAF, EDR, SIEM). Instead, it provides the "Last Mile Runtime Defense" for AI Agent execution boundaries in a modern Defense-in-Depth architecture:

┌─────────────────────────────────────────────────────────────┐ │ Layer 1: Network Perimeter │ WAF (Cloudflare, Palo Alto) │ -> Blocks L3-L7 SQLi/DDoS ├──────────────────────────────┼──────────────────────────────┤ │ Layer 2: Endpoint & Host │ EDR (CrowdStrike, Sentinel) │ -> Blocks OS Ransomware ├──────────────────────────────┼──────────────────────────────┤ │ Layer 3: Identity & IAM │ Keycloak, Active Directory │ -> Manages Human OAuth/JWT ├──────────────────────────────┼──────────────────────────────┤ │ ★ Layer 4: AI Agent Runtime │ DROS PEP/PDP + ATR Sandbox │ -> Blocks Unauthorized Tools └──────────────────────────────┴──────────────────────────────┘ │ ▼ Exports PKI Evidence to Enterprise SIEM (Splunk, Elastic)

💡 Why Traditional Security (WAF/Keycloak) Is Blind to ATS Scenarios

In an indirect prompt injection attack (ATS-001), the hijacked AI Agent possesses a valid Keycloak JWT token. When the agent queries /api/erp/finance, WAF inspects the request: "Valid HTTPS, clean JSON, valid OAuth token. Access Granted!"

Traditional WAFs see a 100% legitimate user making a clean REST API call. The attack is hidden inside the LLM Semantic Context. This is why DROS PEP/PDP is required at the tool execution boundary.

🎯 Agent Threat Scenarios (ATS Matrix & 2026 Real-World Incidents)

DROS-VEP Lite directly reproduces and neutralizes 2026's most notorious real-world AI incidents, mapped to MITRE ATLAS:

Scenario ID Threat Scenario Name 2026 Incident Mapping Target Tool MITRE ATLAS DROS Expected Action

ATS-001 AI Agent 0-Day Sandbox Escape OpenAI GPT-5.6 Sol -> Hugging Face Breach create_socket_connection AML.T0051 DENY ( 0% (LEAKED).

1. Deterministic Replay Engine (benchmark/replay.py)

Replay any historical audit log or evidence artifact package deterministically:

python benchmark/replay.py exec_ATS-001_1784702707

📊 Benchmark Methodology & Measurement Transparency

How is the 26.1 μs policy evaluation latency measured?

Parameter Measurement Setup & Value

Benchmark Hardware Intel Xeon E3-1275 v3 (4C/8T) / 16GB RAM

Execution Sandbox Docker Compose isolated container network

Sample Iterations N = 10,000 iterations per scenario

Policy Decision Latency Median (P50): 26.1 μs | P99: 41.2 μs | Stddev: ±3.4 μs

Measurement Code time.perf_counter_ns() in core/dros_guard.py

🏆 The $40,000 DROS Red Team Grand Challenge

Can you breach DROS’s 26.1μs C-ABI zero-trust execution boundary?

We are offering a 5-Year FREE License of our flagship product, "VajraClaw - Enterprise Air-Gapped License" (Current Early Adopter Price: $7,990/yr, Total Value: $39,950 USD), to the FIRST security researcher or hacker who successfully bypasses the DROS PEP/PDP Guard in this docker sandbox!

⚖️ Official Zero-Ambiguity Proof-of-Bypass Rules

To claim the Grand Prize, your submission MUST meet all three of the following strict criteria:

Unmodified Sandbox Environment:

The exploit must run against the default docker compose up -d environment.

You CANNOT modify the dros-guard container code or disable it (BYPASS_GUARD=true or clicking "Disable DROS Guard" in the UI is strictly forbidden). The Guard must be active.

Concrete Exploit Result (Agentic Overreach):

Path A (Unauthorized Tool Call): Successfully force the support-agent (which only has permissions for /api/erp/inventory) to bypass the DROS physical block and successfully read/exfiltrate data from /api/erp/finance or /api/system/secrets.

Path B (Unauthorized Write): Successfully bypass the DROS PEP/PDP to encrypt or overwrite protected disk files on the ERP container.

Cryptographic Proof & PoC Package:

You must submit a reproducible PoC exploit script.

You must submit the unmodified audit.jsonl log and decision.json evidence package demonstrating either an anomalous ALLOW decision for a blocked route, or proving complete network/container bypass (SSRF/RCE) resulting in data exfiltration while the Guard was running.

🚫 Invalid Claims (Out-of-Scope)

DoS / DDoS: Crashing the DROS server is not a bypass (DROS successfully prevented unauthorized access).

Pure LLM Jailbreaks: If you trick the LLM into wanting to attack, but the DROS Guard successfully blocks the resulting API call in 26.1μs, this is considered a Successful DROS Defense, not a bypass.

How to submit: Post your PoC package to GitHub Discussions or our Discord #conformance-claims. The first verified submission timestamp wins the Grand Prize!

🏅 RFC-010 Draft Protocol Conformance Harness

Third-party AI Agent Frameworks (OpenAI Agent SDK, LangGraph, CrewAI, AutoGen, OpenClaw) can evaluate their runtime security across 3 certification tiers:

Level 1 (Core): Identity Token (DIT) + PEP Tool Interception + Structured Audit Logging.

Level 2 (Enterprise): Policy Explainability (Policy ID) + Evidence Package (SHA-256 Digest) + Multi-Agent Role Isolation.

Level 3 (High Assurance): Cryptographic Attestation + Tamper Detection + Deterministic Replay.

ℹ️ Disclaimer: The included conformance harness validates implementations against the RFC-010 Draft specification. Passing the test indicates conformance to this draft, not certification by an independent standards body.

💎 Product Editions & Licensing

Feature / Capability Community ($0 Free) Hacker ($149/yr or $19/mo - 1k Free Promo) Professional ($499/yr / Team) Enterprise Swarm (Commercial)

Target Audience Students & Researchers Freelancers & Small AI Startups Mid-sized AI Engineering Teams Fortune 500, Banks, Government

Concurrent Roles Max 2 Roles Up to 5 Roles Up to 25 Roles Unlimited (500+ Swarm Production)

ATS Scenarios ATS-001 Single ATS-001 ~ ATS-005 Full Matrix ATS-001 ~ ATS-005 + Custom Unlimited Custom Red Team Crucibles

Connectors REST Mock Enterprise APIs REST Mock + CI/CD Harness Keycloak + EspoCRM + Forgejo Live SAP, Active Directory, K8s

Replay & SIEM Local Telemetry Offline Replay Engine (replay.py) Replay + Telemetry Heatmap Unlimited PKI Log & SIEM (Splunk)

Defense Scope AI Agent Tool Governance AI Agent Tool Governance AI Agent Tool Governance AI Agent + Enterprise Ransomware Defense

🎁 Claim Your Free 1-Year Hacker License (🔥 First 1,000 Security Pioneers!)

Verified RFC-010 compliance? Claim a 1-Year FREE Hacker License ($149 Value):

Option 1 (Web Dashboard UI): Open http://localhost:8080 and click "Claim 1-Year Hacker License".

Option 2 (GitHub Discussions Bot): Post conformance_report.json to GitHub Discussions.

Option 3 (Discord Cyber Crucible): Join our Discord Server and post report in #conformance-claims.

Option 4 (Gumroad $0 Checkout): Use 100% OFF Coupon DROS-RFC010-FREE at dr-os.io.

📜 Technical Whitepapers & Specifications

📖 Full Whitepaper (English v2.0): Zero-Trust Execution Governance for Autonomous AI Workloads (DROS 4-Layer Paradigm)

📖 完整白皮書 (繁體中文 v2.0): 自主型 AI 工作負載的零信任執行治理 (DROS 四層防禦縱深架構)

⚡ 4-Page A4 Executive Summary (HTML): Fast visual summary for CISOs & Security Researchers

📋 RFC-010: DROS-VEP Specification Protocol: Open Agent Security & Threat Scenario Protocol

📄 License

Licensed under Apache 2.0. See LICENSE for details.

Resources

Readme

Activity

Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks

Report repository