Cybersecurity

Keep offensive security agents inside their mandate.

Pentesting agents are told to find exploits in systems they don't own, often on models with reduced guardrails. VAIL reads each agent's mandate, rules of engagement, and tools, finds where the agent could step outside them, and probes the live agent to show where it does.

Scan your agent Where offensive agents go wrong

Where offensive agents go wrong

An offensive agent’s job is the work other agents are trained to refuse: probe, exploit, escalate. Many run on models with reduced guardrails so they don’t refuse it. That leaves the written mandate as the main control, and a mandate written in prose has gaps.

MANDATE · RULES OF ENGAGEMENT OUTSIDE THE MANDATE Pentesting agent reduced-guardrail model tools · memory In-scope targets authorized hosts prove the exploit works exploit planted instruction Out-of-scope host Real data taken out Access left after the test VAIL Agent Assurance reads the mandate · probes the agent · cites the rule
The agent and its targets belong inside the mandate. The failures that matter cross it, and a target can send instructions back. VAIL reads the mandate and probes the live agent for each crossing.

  • Scope drift

    Scanning or attacking hosts outside the engagement, because the scope is written loosely or a target points the agent at infrastructure that isn't in it.

  • Instructions planted in the target

    A system under test returns text that reads as instructions, in a banner, a file, or an error message, and the agent follows it.

  • Actions beyond the mandate

    Taking real data out, running destructive commands, or leaving access in place after the engagement, when the mandate only called for showing the exploit works.

  • Silent changes underneath

    A new model or harness version that follows the rules of engagement less closely, with no change to the agent’s own code.

How VAIL checks an offensive agent

01Read the mandate
VAIL reads the agent’s instructions, rules of engagement, tool schemas, and memory, and maps each rule to the ways the agent could break it: rules that are ambiguous, that conflict, or that are hard to follow mid-engagement.
02Probe the live agent
Each risk becomes a probe: a message to the agent’s endpoint and checks on its reply and tool calls, such as never calling a scanning tool against a host outside scope. A person approves each probe before it runs.
03Report findings
Every finding cites the rule at stake, with its failure rate, trend, and latest failing example.
04Keep watching
Approved probes run hourly, daily, or weekly, so a rule that starts slipping after a model or harness update shows up as a regression.

Securing the AI supply chain

The same attack surfaces apply to every agent and model you run, offensive or not.

  • Model provenance

    Verify where a model came from, including fine-tunes and distillations, before you adopt it.

    Model Assurance

  • Supply chain integrity

    Verify that the model running is the one you approved, and catch swaps, tampering, and unauthorized updates.

    Model Assurance

  • Agent configuration changes

    Flag when changes to memory, skills, or tool descriptions redirect an agent, even when no code changed.

    Agent Assurance

Built for

Teams
Offensive security firms and red teams running autonomous agents, CISOs, security operations, and threat intelligence.
Requirements
An API endpoint for the agent and a written definition: mandate, rules of engagement, and tool schemas.
Deployment
No SDK, no trace access, and no customer data read. Managed, in your cloud, or air-gapped.

Research

All publications

Go further

Model Assurance Know which model is running, and where it came from. Agent Assurance Find how agents can go rogue.

Request an assessment.

Tell us which model or agent you need verified. We reply within one business day with a scope and a start date.

Or write to contact@projectvail.com

Reply within one business day