Validate autonomous agent action boundaries before release.
Eresus tests how AI agents can be abused across user intent, tool permissions, memory, retrieval, approval flows, and API actions using realistic scenarios.
Vulnerabilities our researchers found and disclosed
Public advisories credited to the Eresus research team. The same people run your engagement.
This engagement creates value fastest for teams like these.
AI product and platform teams
Teams shipping LLM, RAG, MCP, agent, or model-intake workflows into internal or customer-facing environments.
Security leaders expanding into AI
Organizations that already run pentest programs and now need guardrail, prompt, and tool-abuse validation.
Teams that need explainable hardening
Groups that need policy, prompt, MCP, and runtime findings translated into concrete mitigations and release decisions.
Scope
Risk signals
Outcomes
Evidence standard
Proof you can inspect. Boundaries you can plan around.
Every engagement is bounded by written authorization, evidence handling, and a clear handoff. These are the defaults; the signed scope can tighten them.
Evidence you receive
- Tested prompt, agent, RAG, MCP, and tool-use paths tied to real workflows.
- Redacted transcripts and request/response evidence for validated failures.
- Policy, identity, tool-scope, and rollout remediation guidance.
- Retest status for critical guardrail changes.
Explicit exclusions
- Compliance certification or a claim that the model is safe.
- Training on, retaining, or redistributing customer data or model weights.
- Unapproved destructive tool calls or abuse of third-party systems.
- A guarantee that every prompt or agent path has been discovered.
Not scanner output. Offensive work that produces proof.
Scope and objective
We align assets, workflows, user roles, testing windows, and safe operating boundaries before execution starts.
Expert validation
Eresus analysts validate exploitability and business impact instead of forwarding automated scanner output.
Proof, fix, retest
Each finding ships with evidence, impact, remediation guidance, and retest steps so teams can close risk quickly.
The questions buyers want answered early.
What AI surfaces do you test?+
Is this just prompt injection testing?+
Do you translate findings into engineering actions?+
We tie risk to business impact.
Findings do not stop at severity labels. We explain which customer workflow, data class, or operational objective is affected.
Deliverables work for engineers and executives.
Engineering teams get reproducible proof and remediation direction; leadership gets the risk narrative, priority, and closure status.
Research and advisories that support this service motion.
AI Agent Traps: Web Attacks Against Agents
How hidden web content, poisoned context, and tool access can manipulate autonomous AI agents in real enterprise workflows.
Beyond Jailbreaks: Contextual Red Teaming for Agentic AI
Why standalone jailbreak tests miss agent risk, and how to test indirect prompt injection, retrieval boundaries, tool permissions, and recovery in multi-step systems.
Automated Red Teaming for Agentic AI Workflows: What to Test and What to Measure
A practical framework for testing prompt injection, tool abuse, data exposure, excessive agency, and recovery in enterprise agent workflows.
Unauthenticated Remote Code Execution via Arbitrary Command Injection in MCPHub Server Registration
MCPHub accepts attacker-controlled command and args values during server registration and spawns them through STDIO, enabling full remote code execution on the host.
Authentication Bypass via skipAuth Configuration Grants Full Admin Access in MCPHub
When skipAuth is enabled, MCPHub bypasses both authentication and admin authorization checks, allowing any unauthenticated user to access privileged API functionality.
Let’s scope this work against the surface that matters most.
Whether this starts as a pilot, a single application, a critical API, an AI agent flow, or a wider program, we start from the highest-impact surface.