We find what hides inside AI agents.
PitSense is a security research company for AI agent systems. We attack the harness, tools, memory and model as one running system, and prove every finding with a replay you can run yourself.
A pit viper hunts in total darkness. It reads heat, not light, and strikes at what nothing else can see.
Agent vulnerabilities live in the same kind of dark. They are not in the model alone, and not in the code alone. They appear only when a harness, its tools, its memory and a model run together.
Code review and model evaluations each see one part. We test the running system, where the failures actually happen.
The whole system
We rebuild your agent setup in a sealed sandbox: permissions, hooks, MCP servers, memory and model. Then we attack it the way an adversary would.
Proof over opinion
Recorders outside the agent decide what happened. A model saying an attack worked never counts as a finding.
A fix that holds
Every finding comes with a patch, and the same replay has to fail against it before we call the issue closed.
Seven ways a running agent gets compromised
Each class needs the code, the model and the harness together, which is why single-layer tools miss them. Findings are mapped to the OWASP Agentic Top 10 and MITRE ATLAS.
Approval bypass
A gated action runs without anyone approving it.
tool result/hook/actionSandbox escape
Ordinary tools reach outside the box they were given.
repo file/path join/host filesystemTaint laundering
Untrusted web text ends up driving a trusted action.
web page/shell/approved actionMCP poisoning
A tool changes its behaviour after you approved it.
MCP server/tool description/secret fileConfused deputy
A low-privilege agent borrows the reach of a high-privilege one.
worker agent/orchestrator/deployMemory poisoning
Planted in one session, triggered in a later one.
document/memory/later actionCredential reach
A secret the agent can read ends up on an attacker's host.
issue text/environment/attacker host
A finding counts only when the replay says so
Each attack runs five times with the payload and five times without it. An independent recorder has to see the effect. Then the patch has to make it stop.
- attackThe effect is recorded in at least 3 of 5 runs.
- controlWithout the payload, it appears in 0 of 5.
- patchedWith the fix applied, the same replay fires 0 of 5.
The replay then moves into CI as a regression test and runs again on every change.
Research on the frameworks agents are built with
Our work so far targets widely used open-source agent frameworks. Findings are reported privately to maintainers and published after a fix ships.
See a finding proven, live
A briefing walks through a real campaign against a local target, then the replay and patch for one of our findings.