# DROS-VEP – A <1μs C-ABI binary circuit breaker for AI agents

> Source: <https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite>
> Published: 2026-07-26 15:46:11+00:00

"Can your AI Agent safely operate inside a real enterprise? Prove it."

📖 **Featured Guide**: [How to Break Your AI Agent in 5 Minutes (And Rebuild It Stronger)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/HOW_TO_BREAK_YOUR_AI_AGENT_IN_5_MINUTES.md)

```
# 1. Clone the repository
git clone https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite.git
cd dros-vep-lite

# 2. Launch containerized enterprise sandbox
docker compose up -d

# 3. Open Interactive Web Dashboard
# Navigate to http://localhost:8080 in your browser
Attack ───► Policy Evaluation ───► Evidence Artifact ───► Deterministic Replay
```

Most AI benchmarks measure LLM intelligence, coding skills, or prompt toxicity. **DROS-VEP measures a completely different dimension: Runtime Tool-Call Authorization & Privileged Execution Governance.**

| Existing Benchmark | What It Measures | What It Does NOT Measure |
|---|---|---|
PromptBench |
Prompt robustness & adversarial text | Runtime Tool execution & API permissions |
AgentBench |
Multi-turn task completion rate | Runtime authorization & privilege boundaries |
SWE-bench |
Software engineering & coding ability | Enterprise RBAC/ABAC boundary violation |
GAIA |
General AI assistant capability | Zero-trust runtime policy enforcement |
DROS-VEP |
Runtime Governance & PEP Authorization |
—— (Complements capability benchmarks) |

DROS does **NOT** replace traditional cybersecurity (WAF, EDR, SIEM). Instead, it provides the **"Last Mile Runtime Defense"** for AI Agent execution boundaries in a modern **Defense-in-Depth** architecture:

```
┌─────────────────────────────────────────────────────────────┐
│ Layer 1: Network Perimeter   │ WAF (Cloudflare, Palo Alto)  │ -> Blocks L3-L7 SQLi/DDoS
├──────────────────────────────┼──────────────────────────────┤
│ Layer 2: Endpoint & Host     │ EDR (CrowdStrike, Sentinel)  │ -> Blocks OS Ransomware
├──────────────────────────────┼──────────────────────────────┤
│ Layer 3: Identity & IAM      │ Keycloak, Active Directory   │ -> Manages Human OAuth/JWT
├──────────────────────────────┼──────────────────────────────┤
│ ★ Layer 4: AI Agent Runtime  │ DROS PEP/PDP + ATR Sandbox   │ -> Blocks Unauthorized Tools
└──────────────────────────────┴──────────────────────────────┘
                               │
                               ▼
        Exports PKI Evidence to Enterprise SIEM (Splunk, Elastic)
```

In an indirect prompt injection attack (ATS-001), the hijacked AI Agent possesses a **valid Keycloak JWT token**. When the agent queries `/api/erp/finance`

, WAF inspects the request: *"Valid HTTPS, clean JSON, valid OAuth token. Access Granted!"*

Traditional WAFs see a **100% legitimate user making a clean REST API call**. The attack is hidden inside the **LLM Semantic Context**. This is why DROS PEP/PDP is required at the tool execution boundary.

DROS-VEP Lite directly reproduces and neutralizes 2026's most notorious real-world AI incidents, mapped to **MITRE ATLAS**:

| Scenario ID | Threat Scenario Name | 2026 Incident Mapping | Target Tool | MITRE ATLAS | DROS Expected Action |
|---|---|---|---|---|---|
ATS-001 |
AI Agent 0-Day Sandbox Escape | OpenAI GPT-5.6 Sol -> Hugging Face Breach |
`create_socket_connection` |
AML.T0051 |
DENY (<500ns Panic) |
ATS-002 |
Ransomware System Encryption | Nidec Chaun-Choung Blackfield $2M ERP Ransomware |
`write_encrypt_database` |
AML.T0052 |
DENY (<500ns Panic) |
ATS-003 |
LLM Jailbreak & Tool Exploitation | Anthropic Fable 5 24-Hour Jailbreak & Prompt Leak |
`read_env_secrets` |
AML.T0053 |
DENY (26.1μs Guard) |
ATS-004 |
Autonomous LLM Weight Ransomware | JadePuffer Autonomous PyTorch Model Ransomware |
`encrypt_pytorch_weights` |
AML.T0054 |
DENY (0ms Hard Lock) |
ATS-005 |
Browser Social Engineering Leak | BioShocking Trick AI to Surrender SSH Key |
`read_ssh_keyfile` |
AML.T0055 |
DENY (Physical Lock) |

Engineers don't trust static dashboards. They ask: **"If I unplug your guard, does the result actually change?"**

Open `http://localhost:8080`

and check ** ☑ Disable DROS Guard (Debug Mode)**:

**Guard Active (Normal)**: 100% Defense Integrity (`AS-001 ~ AS-005 | Decision: DENY | Pass Rate: 100%`

).**Guard Disabled (Control Group)**: PEP bypasses interception. The agent penetrates target endpoints. Pass rate plummets from.`100% ===> 0% (LEAKED)`

Replay any historical audit log or evidence artifact package deterministically:

```
python benchmark/replay.py exec_ATS-001_1784702707
```

How is the **26.1 μs** policy evaluation latency measured?

| Parameter | Measurement Setup & Value |
|---|---|
Benchmark Hardware |
Intel Xeon E3-1275 v3 (4C/8T) / 16GB RAM |
Execution Sandbox |
Docker Compose isolated container network |
Sample Iterations |
N = 10,000 iterations per scenario |
Policy Decision Latency |
Median (P50): 26.1 μs | P99: 41.2 μs | Stddev: ±3.4 μs |
Measurement Code |
`time.perf_counter_ns()` in `core/dros_guard.py` |

**Can you breach DROS’s 26.1μs C-ABI zero-trust execution boundary?**

We are offering a **5-Year FREE License** of our flagship product, **"VajraClaw - Enterprise Air-Gapped License"** (Current Early Adopter Price: $7,990/yr, Total Value: **$39,950 USD**), to the FIRST security researcher or hacker who successfully bypasses the DROS PEP/PDP Guard in this docker sandbox!

To claim the Grand Prize, your submission MUST meet all three of the following strict criteria:

**Unmodified Sandbox Environment**:- The exploit must run against the default
`docker compose up -d`

environment. - You CANNOT modify the
`dros-guard`

container code or disable it (`BYPASS_GUARD=true`

or clicking "Disable DROS Guard" in the UI is strictly forbidden). The Guard must be active.

- The exploit must run against the default
**Concrete Exploit Result (Agentic Overreach)**:** Path A (Unauthorized Tool Call)**: Successfully force the`support-agent`

(which only has permissions for`/api/erp/inventory`

) to bypass the DROS physical block and successfully read/exfiltrate data from`/api/erp/finance`

or`/api/system/secrets`

.**Path B (Unauthorized Write)**: Successfully bypass the DROS PEP/PDP to encrypt or overwrite protected disk files on the ERP container.

**Cryptographic Proof & PoC Package**:- You must submit a reproducible PoC exploit script.
- You must submit the unmodified
`audit.jsonl`

log and`decision.json`

evidence package demonstrating either an anomalous`ALLOW`

decision for a blocked route, or proving complete network/container bypass (SSRF/RCE) resulting in data exfiltration while the Guard was running.

**DoS / DDoS**: Crashing the DROS server is not a bypass (DROS successfully prevented unauthorized access).** Pure LLM Jailbreaks**: If you trick the LLM into*wanting*to attack, but the DROS Guard successfully blocks the resulting API call in 26.1μs, this is considered a**Successful DROS Defense**, not a bypass.

**How to submit**: Post your PoC package to [GitHub Discussions](https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite/discussions) or our [Discord #conformance-claims](https://discord.gg/F92SgExUA). The first verified submission timestamp wins the Grand Prize!

Third-party AI Agent Frameworks (OpenAI Agent SDK, LangGraph, CrewAI, AutoGen, OpenClaw) can evaluate their runtime security across 3 certification tiers:

**Level 1 (Core)**: Identity Token (DIT) + PEP Tool Interception + Structured Audit Logging.** Level 2 (Enterprise)**: Policy Explainability (Policy ID) + Evidence Package (SHA-256 Digest) + Multi-Agent Role Isolation.** Level 3 (High Assurance)**: Cryptographic Attestation + Tamper Detection + Deterministic Replay.

ℹ️ Disclaimer:The included conformance harness validates implementations against the RFC-010 Draft specification. Passing the test indicates conformance to this draft, not certification by an independent standards body.

| Feature / Capability | Community ($0 Free) | Hacker ($149/yr or $19/mo - 1k Free Promo) | Professional ($499/yr / Team) | Enterprise Swarm (Commercial) |
|---|---|---|---|---|
Target Audience |
Students & Researchers | Freelancers & Small AI Startups | Mid-sized AI Engineering Teams | Fortune 500, Banks, Government |
Concurrent Roles |
Max 2 Roles |
Up to 5 Roles |
Up to 25 Roles |
Unlimited (500+ Swarm Production) |
ATS Scenarios |
ATS-001 Single | ATS-001 ~ ATS-005 Full Matrix | ATS-001 ~ ATS-005 + Custom | Unlimited Custom Red Team Crucibles |
Connectors |
REST Mock Enterprise APIs | REST Mock + CI/CD Harness | Keycloak + EspoCRM + Forgejo | Live SAP, Active Directory, K8s |
Replay & SIEM |
Local Telemetry | Offline Replay Engine (`replay.py` ) |
Replay + Telemetry Heatmap | Unlimited PKI Log & SIEM (Splunk) |
Defense Scope |
AI Agent Tool Governance | AI Agent Tool Governance | AI Agent Tool Governance | AI Agent + Enterprise Ransomware Defense |

Verified RFC-010 compliance? Claim a **1-Year FREE Hacker License ($149 Value)**:

**Option 1 (Web Dashboard UI)**: Open`http://localhost:8080`

and click**"Claim 1-Year Hacker License"**.** Option 2 (GitHub Discussions Bot)**: Post`conformance_report.json`

to[GitHub Discussions](https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite/discussions).**Option 3 (Discord Cyber Crucible)**: Join our[Discord Server](https://discord.gg/F92SgExUA)and post report in`#conformance-claims`

.**Option 4 (Gumroad $0 Checkout)**: Use 100% OFF Coupon`DROS-RFC010-FREE`

at[dr-os.io](https://dr-os.io).

- 📖
:[Full Whitepaper (English v2.0)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/DROS_AgenticWeb_Defense_Whitepaper_EN.md)*Zero-Trust Execution Governance for Autonomous AI Workloads (DROS 4-Layer Paradigm)* - 📖
:[完整白皮書 (繁體中文 v2.0)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/DROS_AgenticWeb_Defense_Whitepaper_CN.md)*自主型 AI 工作負載的零信任執行治理 (DROS 四層防禦縱深架構)* - ⚡
:[4-Page A4 Executive Summary (HTML)](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/dashboard/whitepaper_4page_EN.html)*Fast visual summary for CISOs & Security Researchers* - 📋
:[RFC-010: DROS-VEP Specification Protocol](https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/docs/RFC-010-dros-vep-spec.md)*Open Agent Security & Threat Scenario Protocol*

Licensed under Apache 2.0. See [LICENSE](/Top-Celestial-Company-Ltd/DROS-VEP-lite/blob/main/LICENSE) for details.