ARES: Agent Risk & Exposure Sentinel

Paste a security vulnerability notice, a vendor email or a new rule. ARES traces every AI agent, tool and workflow it touches, pauses the risky ones in seconds, and tells each owner the next step.

Comment

Inspiration

$4.99M per breach. 43 days to patch. 80% of companies have seen AI agents go off-script. 82% of companies use AI agents, but only 44% have policies to secure them. These agents answer customers, move money and handle personal data, all on shared tools. When a flaw hits one tool, companies spend days asking "what's affected?" while the risky workflows keep running. We built ARES, the Agent Risk & Exposure Sentinel, to close that gap: a safety layer that contains the risk in seconds.

What it does

1 notice in. Every affected agent found. Risky workflows paused in seconds. A security vulnerability notice, vendor email or new rule arrives, and someone has to stop the damage fast. ARES confirms what the change is, maps every affected agent and workflow, pauses the high-risk ones on its own, and sends each owner one clear next step. In our demo, 1 notice reaches 3 agents and 3 workflows: 2 are paused, 1 is warned and 228 are confirmed safe. Safe work keeps running, and each workflow restarts by itself once the fix is in. Preview mode shows what a new rule would stop before anyone turns it on.

How we built it

0 AI models in the decision path. 1 line to explain every decision. Software that pauses live operations must be right every time and easy to audit. So code decides, and AI only handles language:

  • We map how tools, agents, workflows and legal duties connect, as one graph.
  • From the change $c$, we follow every link. Everything within $k$ steps is exposed: $R_k(c) = {\, v : d(c, v) \le k \,}$.
  • A workflow is high-risk if it sends data outside the company or carries a legal duty, like SOX 404.
  • OpenAI reads messy text and writes owner messages, and code checks every message before it goes out.
  • The stack is Python, LangGraph and FastAPI for the engine, and React with TypeScript for the console.

The result: the same input always gives the same answer.

Challenges we ran into

Trust was the hardest problem. No company will let an AI pause its finance systems, input is messy, and the workflow owner often can't fix the broken tool. We kept AI out of every pause decision. ARES asks a person when a change is unclear, and Escalate brings in the team that owns the fix. ARES never guesses with critical operations, and every problem reaches someone who can solve it.

Accomplishments that we're proud of

3 of 3 change kinds handled, plus the stretch goal. The brief asked for 2 kinds of change, handled live. We built one engine for all 3: a faulty tool, new personal data and a new rule. Preview mode, the stretch goal, always matches the real run. 35 tests pass in about 2 seconds, and ARES keeps working even when every AI model is down.

What we learned

Trust beats cleverness. We started out thinking AI should do most of the work. When customer data and financial systems are at stake, people need to check the decision. So we moved AI to the edges and made ARES say "here is what I understood" before it acts. Showing what's safe matters as much as stopping what's dangerous.

What's next for ARES

From seconds to zero: no human paste needed. Today, a person pastes the notice and the company map is built by hand. Next, ARES will read security feeds directly, build the map from existing company data, and reach owners through Slack and e-mail. Then it can stand watch 24/7 and contain threats before anyone reads the warning. The market for securing AI will reach $4.8B in 2027, and ARES is built for it.

Built With

Share this project:

Updates

Submission history