Cerbere-AG is a three-layer security guardrail for AI agents: Regex, ML, and an LLM Judge. AI agents are unpredictable. They improvise and act with full autonomy. I built Cerbere-AG (named after the three-headed dog, Cerberus) so that autonomy doesn’t come at the cost of control. Why three layers? Our benchmarks show it: → Regex alone lets more than 30% of attacks through. → ML pushes recall up to 100% in some of our tests, but raises false positives. → The LLM Judge resolves the ambiguous cases ML can’t classify. It also looks at context. Cerbere-AG follows tool calls, checks whether they’re legitimate, and then allows them, blocks them, or flags them for real-time human approval. Agents keep their autonomy, and humans keep control. Everything is audited too. The collector gathers spans and traces into an audit trail that is independent from the agent and supports compliance. And like any tool, it has limits. That’s why observability matters: security isn’t only about blocking attacks, it’s about understanding what happened, what was allowed, what was blocked, and why. Open source and free for now. Try it and give me your honest feedback 👇 github.com/chrismsmr-celcom/… app.cerbereag.site

Why Cerbere? Vigilance. Three heads, three layers: fast rules, ML, and an LLM judge. And one principle: nothing reaches the real world without being authorized. Autonomy needs boundaries. Cerbere enforces them at runtime.

I ran Cerbere AG against 2,003 test cases: 1,000 attacks, 703 benign prompts, and 300 hard negatives. Results with regex + ML: • 100% attack recall • 571.8 ms p95 latency • 2.28% false-positive rate on benign prompts • 1.33% false-positive rate on hard negatives The trade-off is clear: catching attacks is only half the problem. Legitimate requests must keep working, too. The next challenge is reducing false positives without losing detection coverage. Building runtime security for AI agents, one benchmark at a time.

AI agents are becoming more autonomous. But autonomy without control is a risk. I built Cerbere AG, an open-source runtime security layer that sits between AI agents and their tools to detect, block, and require human approval for sensitive actions, with observability and audit trails. Built from Kinshasa. Now in public beta. I’m looking for design partners and developers to test Cerbere in real-world environments and help shape what comes next. Open source. Free. Benchmarks available on GitHub. 🔗 github.com/chrismsmr-celcom/… Collector: app.cerbereag.site If you’re building or deploying AI agents, let’s talk.

Coming soon: Luvia, a travel agent that lives in WhatsApp. Search flights, book, get your itinerary, receive alerts when something changes, and ask any travel question, all in a simple chat. No app to install, no forms. Voice notes welcome. Payment stays secure: Luvia sends you a link to luviaplace.com to complete it. We’re also building Luvia for travel agencies. Your clients, your brand, your relationship, with an assistant that handles the repetitive work 24/7 so your team can focus on advice. Travel agencies bring the trust. Luvia brings the speed. This is a preview of what’s coming. Want early access, or want Luvia for your agency? Join the waitlist: travelwithluvia.com

Cerbere AG v0.6.1: new benchmark on 2,003 security patterns. 99.0% attack recall across 1,000 attack samples, with 0 false positives across 703 benign samples and 300 hard negatives. The remaining misses are concentrated in obfuscated and indirect prompt injection. Current challenge: latency. Median 378 ms, p95 2.49 s. Next focus: stronger input normalization, better context-aware detection, and lower runtime overhead. Built from Kinshasa. Benchmark results, limitations, and reproducibility matter more than impressive claims. github.com/chrismsmr-celcom/…

To reduce friction and make Cerbere AG fit seamlessly into your production environment and existing tools, we've redesigned the collector interface to make it smoother, faster, and more intuitive. We've also introduced new features, including Compliance and Agent Graph. But our core philosophy remains unchanged: Keep your AI agents autonomous without losing control. Try Cerbere AG: app.cerbereag.site GitHub: github.com/chrismsmr-celcom/… Questions or feedback? My DMs are open. Thanks for your support! @CerbereAg

New Cerbere AG benchmark results. Regex alone detected 46% of prompt injection attacks. Our 3-layer engine (Regex + ML + LLM) achieved: • 100% attack detection (100/100) • 0 false positives (0/200) • No degraded layers Early results. Limited sample. Scaling to 10K tests. Security needs more than regex. github.com/chrismsmr-celcom/… try cerbere AG: app.cerbereag.site

I’m building @CerbereAg, a security control layer for AI agents. Today, I recorded Cerbere interacting with Luce, my AI assistant, during execution. The goal: make agent activity observable and enforce security controls at the execution layer — not just rely on prompt-level safeguards. Still early. Still building from Kinshasa. Here’s what it looks like in practice. 👇

I’m not looking for vanity metrics. I want developers who will actually integrate Cerbere, test it against real agent workflows, and tell me what breaks. If that’s you, let’s talk.

I’m building Cerbere-AG, a control layer for AI agents. As agents gain access to APIs, databases, emails, and external tools, how do you know what they’re actually doing — and stop risky actions before they cause damage? Cerbere helps developers observe agent activity, detect risky actions, enforce policies, and keep an audit trail. I’m looking for: • Developers building AI agents • Teams running agents in production • Design partners willing to test Cerbere and shape the roadmap Cerbere is currently free during development. The local version will remain free. GitHub: github.com/chrismsmr-celcom/… Dashboard: app.cerbereag.site If you’re building agents, I’d like to hear what you’re using today and where your security gaps are. DMs are open.

I’m a solo developer building Cerbere AG — a security/control layer for AI agents. I built the SDK, runtime, dashboard, detection system and benchmark myself. Now I need something I can’t build alone: real agents to test it on. If you’re currently deploying an AI agent that can: → call APIs/tools → access sensitive data → use MCP → send emails / execute actions → make decisions autonomously I’d like to give you Cerbere for free and learn from what happens in real-world usage. No sales pitch. No credit card. I’m looking for 5–10 teams willing to let me stress-test the product, break it, and give me brutally honest feedback. If you’re building an agent in production or close to production, reply or DM me. I’ll personally help you integrate it.

Your AI agent is in production. Here's what can go wrong, and what Cerbere AG does about it. 🔴 Your agent reads a .env file, then a prompt injection tells it to send the contents to an attacker's URL.
🛡️ Cerbere tracks the data flow. A SECRET reaching an external tool is blocked at execution time, even when it's encoded in base64, hex or URL-encoding. 🔴 The injection is hidden with lookalike characters, zero-width spaces or spelled-out words, so your filter sees nothing.
🛡️ Cerbere normalizes the text and scans it again. Clean text is still checked first, so you don't get extra false positives. 🔴 Your agent calls a tool it should never touch.
🛡️ Tool policies are scoped per agent. Each agent gets its own allowed tools, not one global list. 🔴 A risky action should not run without a human saying yes.
🛡️ Cerbere can return "require approval". The action waits in a queue until someone approves or rejects it. 🔴 Emails, card numbers or SSNs leak through tool calls and outputs.
🛡️ PII detection runs separately from injection detection, so each one can be tuned on its own. 🔴 Something went wrong and nobody knows why the agent did it.
🛡️ Every tool call is recorded as a span with its risk score and taint level, so you can replay what happened and why it was blocked or allowed. 🔴 The agent escalates step by step, each action looking harmless on its own.
🛡️ Cerbere looks at the trajectory, not just single calls, and flags escalation patterns. 🔴 Your team has no idea what each agent costs.
🛡️ Token usage is counted per call and tied to the agent that made it. Counting still works offline. 🔴 You can't change the agent's code.
🛡️ Plug Cerbere's tools into any MCP client with one command: claude mcp add cerbereag --transport sse app.cerbereag.site/mcp/sse 🔴 "My LLM already has a regex for that."
🛡️ We benchmark in public: 91.5% recall at 0% false positives with regex, 98.1% recall when ML is added. We publish the limits too. 🔴 Security tools are heavy to adopt.
🛡️ pip install cerbere-ag, then one decorator on your tool functions. The demo runs offline, with no collector needed. 🔴 You're afraid your secrets end up on someone else's server.
🛡️ Tracked secrets stay in the agent's memory and are never sent to the collector. Why Cerbere is worth it:
Filters read what goes in. Cerbere watches what the agent does with it: Protect, Observe, Control, with one engine for all three. Open source. Try it, break it, tell me what fails.
 github.com/chrismsmr-celcom/…

See how cerbere-AG works in just a few images simply and effectively especially the human-in-the-loop (HITL) approval process. Feel free to ask questions or try out cerbere-AG: app.cerbereag.site

Try app.cebereag.site for free now And secure all the tools of your AI agents regardless of the supplier Install in a few minutes and secure Docs: cerbereag.site/docs#install

Your AI agent can complete the task successfully. The API returns 200. The UI shows “Done”. No exception. No crash. And it can still be the worst thing that happened. Because “successful execution” doesn’t mean “authorized execution”. The question isn’t only: “What did the agent return?” It’s: “What did the agent actually do?” That’s the layer I’m building Cerbere-AG for.

When a machine acted up in the early days of computing, you'd just turn it off. But an AI agent doesn't "act up" — it does things that look legitimate while quietly executing an attacker's instructions. By the time you notice, the exfiltration is done.There's no alarm for that. So I built one.CERBERE-AG (@CerbereAg) monitors every prompt and every tool call your agents make, in real time — and blocks the ones that cross the line: data exfiltration, dangerous commands, injected instructions.I resigned as CTO of an AI startup to build this, open source, because the need is urgent. Build your agents with cerbere-ag now — and become an early tester. We'd be glad to build this with you. Thank you. app.cerbereag.site github.com/chrismsmr-celcom/…

We benchmarked our prompt-injection detector against the OWASP Top 10 for LLM Applications. Regex alone: 91.5% recall, 0% false positives, sub-2ms latency.
Add a ML layer: 98.1% recall — but latency jumps to ~450ms and false positives climb to 33% on adversarial-looking benign prompts. Full breakdown, reproducible corpus hashes included: cerbereag.site/blog/detectin…