Agent

Assistant

AI Agents go Rogue.
sec0 Controls.

Get Started

sec0 is a universal defense platform for Agentic AI in production, enabling enterprises to continuously govern risk, monitor exposure, and ensure compliance.

{
  "type": "workflow_init",
  "intent": "Process loan #LN-7842 for           Sarah Chen",
  "baseline": "loan_processing_v2",
  "deviation": "0%",
  "status": "ok",
  "sig": "ed25519:a1b2c3..."
}

Agent Attack Surface

Detect PII leaks, prompt injections, tool swaps, and risky egress before the agent completes the run.

Hidden HTML on vendor-site.com forced agent to email the scraped PDF to attacker@evil.com

Indirect Prompt Injection

PII Exfil

A “troubleshooting log” inside Zendesk instructed the LLM agent to forward the ticket thread to ops@malicious.io.

Accidental Data Retention

Healthcare support agent resurfaced last month’s patient notes because the memory store never purged.

Training on Customer Data

Engineer accidentally pasted proprietary chip schematics into the llm.

Detected Malicious Handler Swap

One run swapped to an unapproved tool, hit an external Slack webhook, and copied secrets from a legacy repo.

PII Exfil

A “troubleshooting log” inside Zendesk instructed the LLM agent to forward the ticket thread to ops@malicious.io.

Indirect Prompt Injection

Hidden HTML on vendor-site.com forced agent to email the scraped PDF to attacker@evil.com

Accidental Data Retention

Healthcare support agent resurfaced last month’s patient notes because the memory store never purged.

Training on Customer Data

Engineer accidentally pasted proprietary chip schematics into the llm.

Detected Malicious Handler Swap

One run swapped to an unapproved tool, hit an external Slack webhook, and copied secrets from a legacy repo.

PII Exfil

A “troubleshooting log” inside Zendesk instructed the LLM agent to forward the ticket thread to ops@malicious.io.

Indirect Prompt Injection

Hidden HTML on vendor-site.com forced agent to email the scraped PDF to attacker@evil.com

Accidental Data Retention

Healthcare support agent resurfaced last month’s patient notes because the memory store never purged.

Training on Customer Data

Engineer accidentally pasted proprietary chip schematics into the llm.

Detected Malicious Handler Swap

One run swapped to an unapproved tool, hit an external Slack webhook, and copied secrets from a legacy repo.

Track Agent Posture, in Real time

Gain insight into runtime agent states, drift metrics, and abnormal runs across tenants, clients, and environments.

Track Agent Posture, in Real time

Gain insight into runtime agent states, drift metrics, and abnormal runs across tenants, clients, and environments.

Enabling the next gen of Safe AI Agent Automations

Enabling the next gen
of Safe AI Agent
Automations

Integrates in under 10 lines of code.

Define agent hops and state with single‑line decorators and centralized config for each hop across your network. You bring the keys, auth, and RBAC, and we handle the agent GRC for you.

import { sec0, AgentManager } from 'sec0-sdk';

@sec0.agent(deploy=True, apiKey = config.apiKey)
async function checkoutAgent(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent
.objective('Checkout customer cart')
.setState({ cart_id: input.cartId });
return orchestrateCheckout(ctx, input, manager);
}

@sec0.orchestrator()
async function orchestrateCheckout(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ workflow: 'checkout' });
await manager.invoke('PaymentsGateway.forward', {
server: 'payments',
toolAtVersion: 'charge@1.0',
args: { cartId: input.cartId },
nodeId: 'payments-forward',
});
}

@sec0.gateway()
async function paymentsGateway(
params: { cartId: string },
manager: AgentManager,
) {
await manager.invoke('PaymentsTool.charge', { cartId: params.cartId });
}

@sec0.tool()
async function chargeTool(
ctx: any,
params: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ payment_status: 'charged' });
return { ok: true };
}
import { sec0, AgentManager } from 'sec0-sdk';

@sec0.agent(deploy=True, apiKey = config.apiKey)
async function checkoutAgent(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent
.objective('Checkout customer cart')
.setState({ cart_id: input.cartId });
return orchestrateCheckout(ctx, input, manager);
}

@sec0.orchestrator()
async function orchestrateCheckout(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ workflow: 'checkout' });
await manager.invoke('PaymentsGateway.forward', {
server: 'payments',
toolAtVersion: 'charge@1.0',
args: { cartId: input.cartId },
nodeId: 'payments-forward',
});
}

@sec0.gateway()
async function paymentsGateway(
params: { cartId: string },
manager: AgentManager,
) {
await manager.invoke('PaymentsTool.charge', { cartId: params.cartId });
}

@sec0.tool()
async function chargeTool(
ctx: any,
params: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ payment_status: 'charged' });
return { ok: true };
}

import { sec0, AgentManager } from 'sec0-sdk';

@sec0.agent(deploy=True, apiKey = config.apiKey)
async function checkoutAgent(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent
.objective('Checkout customer cart')
.setState({ cart_id: input.cartId });
return orchestrateCheckout(ctx, input, manager);
}

@sec0.orchestrator()
async function orchestrateCheckout(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ workflow: 'checkout' });
await manager.invoke('PaymentsGateway.forward', {
server: 'payments',
toolAtVersion: 'charge@1.0',
args: { cartId: input.cartId },
nodeId: 'payments-forward',
});
}

@sec0.gateway()
async function paymentsGateway(
params: { cartId: string },
manager: AgentManager,
) {
await manager.invoke('PaymentsTool.charge', { cartId: params.cartId });
}

@sec0.tool()
async function chargeTool(
ctx: any,
params: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ payment_status: 'charged' });
return { ok: true };
}
import { sec0, AgentManager } from 'sec0-sdk';

@sec0.agent(deploy=True, apiKey = config.apiKey)
async function checkoutAgent(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent
.objective('Checkout customer cart')
.setState({ cart_id: input.cartId });
return orchestrateCheckout(ctx, input, manager);
}

@sec0.orchestrator()
async function orchestrateCheckout(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ workflow: 'checkout' });
await manager.invoke('PaymentsGateway.forward', {
server: 'payments',
toolAtVersion: 'charge@1.0',
args: { cartId: input.cartId },
nodeId: 'payments-forward',
});
}

@sec0.gateway()
async function paymentsGateway(
params: { cartId: string },
manager: AgentManager,
) {
await manager.invoke('PaymentsTool.charge', { cartId: params.cartId });
}

@sec0.tool()
async function chargeTool(
ctx: any,
params: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ payment_status: 'charged' });
return { ok: true };
}

import { sec0, AgentManager } from 'sec0-sdk';

@sec0.agent(deploy=True, apiKey = config.apiKey)
async function checkoutAgent(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent
.objective('Checkout customer cart')
.setState({ cart_id: input.cartId });
return orchestrateCheckout(ctx, input, manager);
}

@sec0.orchestrator()
async function orchestrateCheckout(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ workflow: 'checkout' });
await manager.invoke('PaymentsGateway.forward', {
server: 'payments',
toolAtVersion: 'charge@1.0',
args: { cartId: input.cartId },
nodeId: 'payments-forward',
});
}

@sec0.gateway()
async function paymentsGateway(
params: { cartId: string },
manager: AgentManager,
) {
await manager.invoke('PaymentsTool.charge', { cartId: params.cartId });
}

@sec0.tool()
async function chargeTool(
ctx: any,
params: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ payment_status: 'charged' });
return { ok: true };
}
import { sec0, AgentManager } from 'sec0-sdk';

@sec0.agent(deploy=True, apiKey = config.apiKey)
async function checkoutAgent(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent
.objective('Checkout customer cart')
.setState({ cart_id: input.cartId });
return orchestrateCheckout(ctx, input, manager);
}

@sec0.orchestrator()
async function orchestrateCheckout(
ctx: any,
input: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ workflow: 'checkout' });
await manager.invoke('PaymentsGateway.forward', {
server: 'payments',
toolAtVersion: 'charge@1.0',
args: { cartId: input.cartId },
nodeId: 'payments-forward',
});
}

@sec0.gateway()
async function paymentsGateway(
params: { cartId: string },
manager: AgentManager,
) {
await manager.invoke('PaymentsTool.charge', { cartId: params.cartId });
}

@sec0.tool()
async function chargeTool(
ctx: any,
params: { cartId: string },
manager: AgentManager,
) {
manager.agent.setState({ payment_status: 'charged' });
return { ok: true };
}

Add fine-grained policies at all levels.

Define gateway, middleware, and agent policies in one YAML file so you control what runs, what’s blocked, and when to escalate.

tenant: acme-demo
security:
  egress_allowlist: ["https://api.myapp.com/*"]
  limits: { max_payload_kb: 256, max_duration_ms: 10000 }
enforcement:
  deny_on: [agent_data_exfil, agent_malicious_code]
sast:
  enabled: true
  block_on_severity: high
agent_guard:
  enabled: true
  block_on_severity: high
dast:
  enabled: true

tenant: acme-demo
security:
  egress_allowlist: ["https://api.myapp.com/*"]
  limits: { max_payload_kb: 256, max_duration_ms: 10000 }
enforcement:
  deny_on: [agent_data_exfil, agent_malicious_code]
sast:
  enabled: true
  block_on_severity: high
agent_guard:
  enabled: true
  block_on_severity: high
dast:
  enabled: true

tenant: acme-demo
security:
  egress_allowlist: ["https://api.myapp.com/*"]
  limits: { max_payload_kb: 256, max_duration_ms: 10000 }
enforcement:
  deny_on: [agent_data_exfil, 
           agent_malicious_code]
sast:
  enabled: true
  block_on_severity: high
agent_guard:
  enabled: true
  block_on_severity: high
dast:
  enabled: true

Export compliance-ready audit trails within seconds.

Capture signed, structured logs for every agent run and feed them into your existing GRC tools, so audits are powered by real agent evidence instead of manual screenshots.

{"ts": "2025-05-06T10:30:45.123Z",
"tenant": "acme-demo", "env": "prod",
"agent":"checkout-agent@1.0.0",
"run_id":"run-abc123", "step": "charge",
"state": {"cart_id": "C123",
"customer_tier":"gold"},
"deviation_score" :0.03, "policy":
{"decision": "allow"}

{..., 
"run_id": "run-xyz123", "step":"refund",
"state": {"cart_id":"C456", 
"customer_tier": "guest"},"deviation_score":
0.81,"policy": {"decision": "deny",
"rules": ["agent_data_exfil"],
"review_required": true}}

{"ts": "2025-05-06T10:30:45.123Z",
"tenant": "acme-demo", "env": "prod",
"agent":"checkout-agent@1.0.0",
"run_id":"run-abc123", "step": "charge",
"state": {"cart_id": "C123",
"customer_tier":"gold"},
"deviation_score" :0.03, "policy":
{"decision": "allow"}

{..., 
"run_id": "run-xyz123", "step":"refund",
"state": {"cart_id":"C456", 
"customer_tier": "guest"},"deviation_score":
0.81,"policy": {"decision": "deny",
"rules": ["agent_data_exfil"],
"review_required": true}}

{"ts": "2025-05-06T10:30:45.123Z",
"tenant": "acme-demo", "env": "prod",
"agent":"checkout-agent@1.0.0",
"run_id":"run-abc123", "step": "charge",
"state": {"cart_id": "C123",
"customer_tier":"gold"},
"deviation_score" :0.03, "policy":
{"decision": "allow"}

{..., 
"run_id": "run-xyz123", "step":"refund",
"state": {"cart_id":"C456", 
"customer_tier": "guest"},"deviation_score":
0.81,"policy": {"decision": "deny",
"rules": ["agent_data_exfil"],
"review_required": true}}

User

Browser & App Automations

sec0 monitors every agent run in the background, looking for UI changes, new domains, and sensitive data entries.

When a flow drifts or turns risky, sec0 blocks the action in real time and helps the assistant respond safely to the user and notify the application owner immediately.

sec0 monitors every agent run in the background, looking for UI changes, new domains, and sensitive data entries.

When a flow drifts or turns risky, sec0 blocks the action in real time and helps the assistant respond safely to the user and notify the application owner immediately.

sec0 monitors every agent run in the background, looking for UI changes, new domains, and sensitive data entries.

When a flow drifts or turns risky, sec0 blocks the action in real time and helps the assistant respond safely to the user and notify the application owner immediately.

Everything you need to keep your agents on track.

Control risk and deviation.

Ensure application‑specific agents stay on their intended flows and cannot be quietly repurposed.

Control risk and deviation.

Ensure application‑specific agents stay on their intended flows and cannot be quietly repurposed.

Never lose the trail.

Every agent step and decision is logged, so incident response and compliance are always backed by exportable, audit‑ready evidence.

Instantly fix and replay broken runs.

A combination of ML models pinpoint where the agent drifted, remediation through escalation, and re-run from the point of deviation.

Instantly fix and replay broken runs.

A combination of ML models pinpoint where the agent drifted, remediation through escalation, and re-run from the point of deviation.

Protect commmunications.

Keep all agent interactions inside clear, configurable policy boundaries, from first request to final action.

Optimize agent behaviour.

Learn from real usage to define golden paths while keeping risk under control.

Optimize agent behaviour.

Learn from real usage to define golden paths while keeping risk under control.

Security tests on every change.

Automatically test new code and track agent behavior changes to surface regressions and risky paths early. Additionally, we use internal security agents to prevent novel attacks.

View all updates

Sep 28, 2025

False Sense of Safety: Intelligence Without Accountability

Sep 28, 2025

False Sense of Safety: Intelligence Without Accountability

Oct 15, 2025

From Watching to Enforcing Governance in Real Time

Oct 15, 2025

From Watching to Enforcing Governance in Real Time

Nov 20, 2025

Protecting Applications from Agent Risks

Nov 20, 2025

Protecting Applications from Agent Risks

Build & Deploy with sec0 today.

Join us

AI Agents go Rogue. sec0 Controls.

AI Agents go Rogue. sec0 Controls.

AI Agents go Rogue. sec0 Controls.

Agent Attack Surface

Agent Attack Surface

Agent Attack Surface

Track Agent Posture, in Real time

Track Agent Posture, in Real time

Track Agent Posture, in Real time

Enabling the next gen of Safe AI Agent Automations

Enabling the next gen of Safe AI Agent Automations

Enabling the next gen of Safe AI Agent Automations

Integrates in under 10 lines of code.

Add fine-grained policies at all levels.

Export compliance-ready audit trails within seconds.

Browser & App Automations

Browser & App Automations

Browser & App Automations

Everything you need to keep your agents on track.

Control risk and deviation.

Control risk and deviation.

Never lose the trail.

Instantly fix and replay broken runs.

Instantly fix and replay broken runs.

Protect commmunications.

Optimize agent behaviour.

Optimize agent behaviour.

Security tests on every change.

Build & Deploy with sec0 today.

Build & Deploy with sec0 today.

AI Agents go Rogue.
sec0 Controls.

AI Agents go Rogue.
sec0 Controls.

AI Agents go Rogue.
sec0 Controls.

Enabling the next gen
of Safe AI Agent
Automations