{"slug": "dros-vep-a-1ms-c-abi-binary-circuit-breaker-for-ai-agents", "title": "DROS-VEP – A <1μs C-ABI binary circuit breaker for AI agents", "summary": "Top Celestial Company Ltd released DROS-VEP, a sub-microsecond C-ABI binary circuit breaker for AI agents that enforces runtime tool-call authorization and privileged execution governance, directly reproducing and neutralizing 2026's most notorious real-world AI incidents mapped to MITRE ATLAS. The open-source DROS-VEP Lite provides a containerized enterprise sandbox that blocks unauthorized tool executions such as sandbox escapes, ransomware encryption, and LLM jailbreak exploits, complementing traditional cybersecurity layers like WAF and EDR with a last-mile runtime defense for AI agent execution boundaries.", "body_md": "\"Can your AI Agent safely operate inside a real enterprise? Prove it.\"\n\n📖 **Featured Guide**: [How to Break Your AI Agent in 5 Minutes (And Rebuild It Stronger)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/HOW_TO_BREAK_YOUR_AI_AGENT_IN_5_MINUTES.md)\n\n```\n# 1. Clone the repository\ngit clone https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite.git\ncd dros-vep-lite\n\n# 2. Launch containerized enterprise sandbox\ndocker compose up -d\n\n# 3. Open Interactive Web Dashboard\n# Navigate to http://localhost:8080 in your browser\nAttack ───► Policy Evaluation ───► Evidence Artifact ───► Deterministic Replay\n```\n\nMost AI benchmarks measure LLM intelligence, coding skills, or prompt toxicity. **DROS-VEP measures a completely different dimension: Runtime Tool-Call Authorization & Privileged Execution Governance.**\n\n| Existing Benchmark | What It Measures | What It Does NOT Measure |\n|---|---|---|\nPromptBench |\nPrompt robustness & adversarial text | Runtime Tool execution & API permissions |\nAgentBench |\nMulti-turn task completion rate | Runtime authorization & privilege boundaries |\nSWE-bench |\nSoftware engineering & coding ability | Enterprise RBAC/ABAC boundary violation |\nGAIA |\nGeneral AI assistant capability | Zero-trust runtime policy enforcement |\nDROS-VEP |\nRuntime Governance & PEP Authorization |\n—— (Complements capability benchmarks) |\n\nDROS does **NOT** replace traditional cybersecurity (WAF, EDR, SIEM). Instead, it provides the **\"Last Mile Runtime Defense\"** for AI Agent execution boundaries in a modern **Defense-in-Depth** architecture:\n\n```\n┌─────────────────────────────────────────────────────────────┐\n│ Layer 1: Network Perimeter   │ WAF (Cloudflare, Palo Alto)  │ -> Blocks L3-L7 SQLi/DDoS\n├──────────────────────────────┼──────────────────────────────┤\n│ Layer 2: Endpoint & Host     │ EDR (CrowdStrike, Sentinel)  │ -> Blocks OS Ransomware\n├──────────────────────────────┼──────────────────────────────┤\n│ Layer 3: Identity & IAM      │ Keycloak, Active Directory   │ -> Manages Human OAuth/JWT\n├──────────────────────────────┼──────────────────────────────┤\n│ ★ Layer 4: AI Agent Runtime  │ DROS PEP/PDP + ATR Sandbox   │ -> Blocks Unauthorized Tools\n└──────────────────────────────┴──────────────────────────────┘\n                               │\n                               ▼\n        Exports PKI Evidence to Enterprise SIEM (Splunk, Elastic)\n```\n\nIn an indirect prompt injection attack (ATS-001), the hijacked AI Agent possesses a **valid Keycloak JWT token**. When the agent queries `/api/erp/finance`\n\n, WAF inspects the request: *\"Valid HTTPS, clean JSON, valid OAuth token. Access Granted!\"*\n\nTraditional WAFs see a **100% legitimate user making a clean REST API call**. The attack is hidden inside the **LLM Semantic Context**. This is why DROS PEP/PDP is required at the tool execution boundary.\n\nDROS-VEP Lite directly reproduces and neutralizes 2026's most notorious real-world AI incidents, mapped to **MITRE ATLAS**:\n\n| Scenario ID | Threat Scenario Name | 2026 Incident Mapping | Target Tool | MITRE ATLAS | DROS Expected Action |\n|---|---|---|---|---|---|\nATS-001 |\nAI Agent 0-Day Sandbox Escape | OpenAI GPT-5.6 Sol -> Hugging Face Breach |\n`create_socket_connection` |\nAML.T0051 |\nDENY (<500ns Panic) |\nATS-002 |\nRansomware System Encryption | Nidec Chaun-Choung Blackfield $2M ERP Ransomware |\n`write_encrypt_database` |\nAML.T0052 |\nDENY (<500ns Panic) |\nATS-003 |\nLLM Jailbreak & Tool Exploitation | Anthropic Fable 5 24-Hour Jailbreak & Prompt Leak |\n`read_env_secrets` |\nAML.T0053 |\nDENY (26.1μs Guard) |\nATS-004 |\nAutonomous LLM Weight Ransomware | JadePuffer Autonomous PyTorch Model Ransomware |\n`encrypt_pytorch_weights` |\nAML.T0054 |\nDENY (0ms Hard Lock) |\nATS-005 |\nBrowser Social Engineering Leak | BioShocking Trick AI to Surrender SSH Key |\n`read_ssh_keyfile` |\nAML.T0055 |\nDENY (Physical Lock) |\n\nEngineers don't trust static dashboards. They ask: **\"If I unplug your guard, does the result actually change?\"**\n\nOpen `http://localhost:8080`\n\nand check ** ☑ Disable DROS Guard (Debug Mode)**:\n\n**Guard Active (Normal)**: 100% Defense Integrity (`AS-001 ~ AS-005 | Decision: DENY | Pass Rate: 100%`\n\n).**Guard Disabled (Control Group)**: PEP bypasses interception. The agent penetrates target endpoints. Pass rate plummets from.`100% ===> 0% (LEAKED)`\n\nReplay any historical audit log or evidence artifact package deterministically:\n\n```\npython benchmark/replay.py exec_ATS-001_1784702707\n```\n\nHow is the **26.1 μs** policy evaluation latency measured?\n\n| Parameter | Measurement Setup & Value |\n|---|---|\nBenchmark Hardware |\nIntel Xeon E3-1275 v3 (4C/8T) / 16GB RAM |\nExecution Sandbox |\nDocker Compose isolated container network |\nSample Iterations |\nN = 10,000 iterations per scenario |\nPolicy Decision Latency |\nMedian (P50): 26.1 μs | P99: 41.2 μs | Stddev: ±3.4 μs |\nMeasurement Code |\n`time.perf_counter_ns()` in `core/dros_guard.py` |\n\n**Can you breach DROS’s 26.1μs C-ABI zero-trust execution boundary?**\n\nWe are offering a **5-Year FREE License** of our flagship product, **\"VajraClaw - Enterprise Air-Gapped License\"** (Current Early Adopter Price: $7,990/yr, Total Value: **$39,950 USD**), to the FIRST security researcher or hacker who successfully bypasses the DROS PEP/PDP Guard in this docker sandbox!\n\nTo claim the Grand Prize, your submission MUST meet all three of the following strict criteria:\n\n**Unmodified Sandbox Environment**:- The exploit must run against the default\n`docker compose up -d`\n\nenvironment. - You CANNOT modify the\n`dros-guard`\n\ncontainer code or disable it (`BYPASS_GUARD=true`\n\nor clicking \"Disable DROS Guard\" in the UI is strictly forbidden). The Guard must be active.\n\n- The exploit must run against the default\n**Concrete Exploit Result (Agentic Overreach)**:** Path A (Unauthorized Tool Call)**: Successfully force the`support-agent`\n\n(which only has permissions for`/api/erp/inventory`\n\n) to bypass the DROS physical block and successfully read/exfiltrate data from`/api/erp/finance`\n\nor`/api/system/secrets`\n\n.**Path B (Unauthorized Write)**: Successfully bypass the DROS PEP/PDP to encrypt or overwrite protected disk files on the ERP container.\n\n**Cryptographic Proof & PoC Package**:- You must submit a reproducible PoC exploit script.\n- You must submit the unmodified\n`audit.jsonl`\n\nlog and`decision.json`\n\nevidence package demonstrating either an anomalous`ALLOW`\n\ndecision for a blocked route, or proving complete network/container bypass (SSRF/RCE) resulting in data exfiltration while the Guard was running.\n\n**DoS / DDoS**: Crashing the DROS server is not a bypass (DROS successfully prevented unauthorized access).** Pure LLM Jailbreaks**: If you trick the LLM into*wanting*to attack, but the DROS Guard successfully blocks the resulting API call in 26.1μs, this is considered a**Successful DROS Defense**, not a bypass.\n\n**How to submit**: Post your PoC package to [GitHub Discussions](https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite/discussions) or our [Discord #conformance-claims](https://discord.gg/F92SgExUA). The first verified submission timestamp wins the Grand Prize!\n\nThird-party AI Agent Frameworks (OpenAI Agent SDK, LangGraph, CrewAI, AutoGen, OpenClaw) can evaluate their runtime security across 3 certification tiers:\n\n**Level 1 (Core)**: Identity Token (DIT) + PEP Tool Interception + Structured Audit Logging.** Level 2 (Enterprise)**: Policy Explainability (Policy ID) + Evidence Package (SHA-256 Digest) + Multi-Agent Role Isolation.** Level 3 (High Assurance)**: Cryptographic Attestation + Tamper Detection + Deterministic Replay.\n\nℹ️ Disclaimer:The included conformance harness validates implementations against the RFC-010 Draft specification. Passing the test indicates conformance to this draft, not certification by an independent standards body.\n\n| Feature / Capability | Community ($0 Free) | Hacker ($149/yr or $19/mo - 1k Free Promo) | Professional ($499/yr / Team) | Enterprise Swarm (Commercial) |\n|---|---|---|---|---|\nTarget Audience |\nStudents & Researchers | Freelancers & Small AI Startups | Mid-sized AI Engineering Teams | Fortune 500, Banks, Government |\nConcurrent Roles |\nMax 2 Roles |\nUp to 5 Roles |\nUp to 25 Roles |\nUnlimited (500+ Swarm Production) |\nATS Scenarios |\nATS-001 Single | ATS-001 ~ ATS-005 Full Matrix | ATS-001 ~ ATS-005 + Custom | Unlimited Custom Red Team Crucibles |\nConnectors |\nREST Mock Enterprise APIs | REST Mock + CI/CD Harness | Keycloak + EspoCRM + Forgejo | Live SAP, Active Directory, K8s |\nReplay & SIEM |\nLocal Telemetry | Offline Replay Engine (`replay.py` ) |\nReplay + Telemetry Heatmap | Unlimited PKI Log & SIEM (Splunk) |\nDefense Scope |\nAI Agent Tool Governance | AI Agent Tool Governance | AI Agent Tool Governance | AI Agent + Enterprise Ransomware Defense |\n\nVerified RFC-010 compliance? Claim a **1-Year FREE Hacker License ($149 Value)**:\n\n**Option 1 (Web Dashboard UI)**: Open`http://localhost:8080`\n\nand click**\"Claim 1-Year Hacker License\"**.** Option 2 (GitHub Discussions Bot)**: Post`conformance_report.json`\n\nto[GitHub Discussions](https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite/discussions).**Option 3 (Discord Cyber Crucible)**: Join our[Discord Server](https://discord.gg/F92SgExUA)and post report in`#conformance-claims`\n\n.**Option 4 (Gumroad $0 Checkout)**: Use 100% OFF Coupon`DROS-RFC010-FREE`\n\nat[dr-os.io](https://dr-os.io).\n\n- 📖\n:[Full Whitepaper (English v2.0)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/DROS_AgenticWeb_Defense_Whitepaper_EN.md)*Zero-Trust Execution Governance for Autonomous AI Workloads (DROS 4-Layer Paradigm)* - 📖\n:[完整白皮書 (繁體中文 v2.0)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/DROS_AgenticWeb_Defense_Whitepaper_CN.md)*自主型 AI 工作負載的零信任執行治理 (DROS 四層防禦縱深架構)* - ⚡\n:[4-Page A4 Executive Summary (HTML)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/dashboard/whitepaper_4page_EN.html)*Fast visual summary for CISOs & Security Researchers* - 📋\n:[RFC-010: DROS-VEP Specification Protocol](https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/RFC-010-dros-vep-spec.md)*Open Agent Security & Threat Scenario Protocol*\n\nLicensed under Apache 2.0. See [LICENSE](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/LICENSE) for details.", "url": "https://wpnews.pro/news/dros-vep-a-1ms-c-abi-binary-circuit-breaker-for-ai-agents", "canonical_source": "https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite", "published_at": "2026-07-26 15:46:11+00:00", "updated_at": "2026-07-26 15:52:15.369094+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-infrastructure", "ai-tools", "ai-research"], "entities": ["Top Celestial Company Ltd", "DROS-VEP", "MITRE ATLAS", "OpenAI", "Anthropic", "Keycloak", "CrowdStrike", "Splunk"], "alternates": {"html": "https://wpnews.pro/news/dros-vep-a-1ms-c-abi-binary-circuit-breaker-for-ai-agents", "markdown": "https://wpnews.pro/news/dros-vep-a-1ms-c-abi-binary-circuit-breaker-for-ai-agents.md", "text": "https://wpnews.pro/news/dros-vep-a-1ms-c-abi-binary-circuit-breaker-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/dros-vep-a-1ms-c-abi-binary-circuit-breaker-for-ai-agents.jsonld"}}