This article is a living update log. Bookmark and follow the progress!
Preface: Why I Built This
25 years in IT. Sysadmin, developer, architect, tech lead, CTO. Seen everything — from Windows NT server rooms to Kubernetes in production.
Then ChatGPT arrived.
And with it — a wave of "AI-first" products. Companies rushed to integrate LLMs everywhere. RAG, agents, MCP protocols, autonomous systems.
But security?
There is none. Seriously — there just isn’t any.
I watched this and saw the 2000s all over again. When web apps were full of holes, SQL injections worked everywhere, and XSS was the norm. Then OWASP emerged, penetration testing became a profession, and things changed.
We’re at that same point now, only with AI. Prompt injection is SQL inj…
This article is a living update log. Bookmark and follow the progress!
Preface: Why I Built This
25 years in IT. Sysadmin, developer, architect, tech lead, CTO. Seen everything — from Windows NT server rooms to Kubernetes in production.
Then ChatGPT arrived.
And with it — a wave of "AI-first" products. Companies rushed to integrate LLMs everywhere. RAG, agents, MCP protocols, autonomous systems.
But security?
There is none. Seriously — there just isn’t any.
I watched this and saw the 2000s all over again. When web apps were full of holes, SQL injections worked everywhere, and XSS was the norm. Then OWASP emerged, penetration testing became a profession, and things changed.
We’re at that same point now, only with AI. Prompt injection is SQL injection 2.0. Jailbreaks are XSS. RAG poisoning is a new type of supply chain attack.
And nobody is defending.
- Anthropic and OpenAI do safety alignment inside the model
- But what about those who use the models?
- Where’s the firewall for LLMs?
- Where’s the DMZ for agents?
Many rely on traditional InfoSec — WAF, SIEM, DLP. But legacy tools were built for a different reality. They catch SQL injections in HTTP requests just fine, but prompt injection in a JSON "message" field? That’s just text to them. Not malicious intent — user input. It’s not the tools’ fault — they do what they were designed for. AI threats simply require a new class of protection.
Two Years of Research
Since 2024, I’ve tracked every framework, every paper, every CVE in AI security. LangChain, LlamaIndex, Guardrails AI, NeMo Guardrails, Rebuff, Lakera — studied them all. Watched what works, what doesn’t. Built prototypes, threw them away, started over.
Constant cycle: research → prototype → understand what’s wrong → research again.
In parallel, I built an attack database. Jailbreaks from Reddit, papers from arXiv, CVEs from real incidents. 39,000+ payloads don’t get collected in a month.
And in December 2025, the puzzle clicked. Everything accumulated over two years became SENTINEL. Final sprint — six weeks of intense development. But the foundation — that’s years of preparation.
I decided to build it myself. Alone. Because I can and want to — if not me, then who, when experience and knowledge allow it.
What is SENTINEL?
SENTINEL is a complete AI security platform. Not a library. Not "yet another prompt detector". A full ecosystem for protecting and testing AI systems.
Why "complete"?
Because it covers the entire cycle:
1. Detection (Brain) — 212 engines analyze every prompt and response. Not just regex and keywords. Topological data analysis, chaos theory, hyperbolic geometry — math that catches attacks the attacker doesn’t even know about yet.
2. Protection (Shield) — DMZ layer in pure C. Sits between your app and the LLM. Works like a firewall: 6 specialized guards for LLM, RAG, agents, tools, MCP protocols, APIs. Latency < 1ms. 103 tests. Zero memory leaks.
3. Attack (Strike) — Red team out of the box. 39,000+ payloads, 84 attack categories, HYDRA system with 9 parallel heads. Test your AI before someone else does.
4. Kernel (Immune) — Kernel-level protection. For those who want to protect not just AI, but infrastructure. DragonFlyBSD, 6 syscall hooks, 110KB binary.
5. Integration (SDK) — pip install sentinel-llm-security and three lines of code. FastAPI middleware. CLI. SARIF reports for IDEs.
Total: 105K+ lines of code, 700+ source files, open source, Apache 2.0
📊 Platform Statistics
| Metric | Value |
|---|---|
| Brain Engines | 212 (254 files) |
| Strike Payloads | 39,000+ |
| Shield Tests | 103/103 ✅ |
| Source Files | 700+ |
| OWASP LLM Top 10 | 10/10 |
| OWASP Agentic AI | 10/10 |
🧠 Brain — Detection Core
212 engines analyze prompts in real-time. But it’s not about quantity — it’s about the approach.
Our Uniqueness: Strange Math™
Most AI-safety solutions run on regex and stop-word lists. Attacker changes "ignore" to "disregard" — and the defense is blind.
We took a different path. Math you can’t bypass:
Topological Data Analysis (TDA) — A prompt isn’t a string, it’s an object in multi-dimensional space. TDA builds persistent homologies — "holes" in data that remain under deformation. An attacking prompt has different topology, even if words look harmless.
Sheaf Coherence Theory — Local consistency via Grothendieck. Every part of a prompt must be coherent with the whole. Injection creates a coherence break — visible mathematically, even when semantically everything "looks fine".
Chaos Theory and Fractals — Lorenz attractors for token sequences. Normal text has deterministic chaos. Injection creates anomalous dynamics — the phase portrait reveals the attack.
Engine Categories
| Category | Count | What We Catch |
|---|---|---|
| Injection | 30+ | Prompt injection, jailbreak, Policy Puppetry |
| Agentic | 25+ | RAG poisoning, tool hijacking, MCP attacks |
| Math | 15+ | TDA, Sheaf Coherence, Chaos Theory, Wavelets |
| Privacy | 10+ | PII detection, data leakage, canary tokens |
| Supply Chain | 5+ | Pickle security, serialization attacks |
"Strange Math™" — How We’re Different
Standard Approach SENTINEL Strange Math™
───────────────────────── ─────────────────────────
• Keywords • Topological Data Analysis
• Regular expressions • Sheaf Coherence Theory
• Simple ML classifiers • Hyperbolic Geometry
• Static rules • Optimal Transport
• Chaos Theory
What does this mean? Instead of naively "searching for the word ignore", we analyze the topology of the prompt. An attacker can invent a new bypass — but the mathematical structure gives them away.
🛡️ Shield — Pure C DMZ
100% production ready as of January 2026.
Why C? Because a DMZ must be fast, reliable, and dependency-free. No Python in the critical path. No GC. No surprises.
| Metric | Value |
|---|---|
| Lines of Code | 36,000+ |
| Source Files | 139 .c, 77 .h |
| Tests | 103/103 pass |
| Warnings | 0 |
| Memory Leaks | 0 (Valgrind CI) |
Use Case Scenarios
🏠 Startup / Small Team
You have one server with an LLM support bot. Shield installs as a proxy — all API traffic goes through it. Prompt injection? Blocked. API key leak in response? Redacted. Basic protection in 10 minutes.
🏢 Mid-size Business / 10+ Offices
Dozen AI services: RAG for documentation, agents for automation, chatbots for customers. Shield works as centralized DMZ with zones: internal, partners, external. Different policies for different zones. Single audit point. Kubernetes-ready — 5 manifests out of the box.
🌍 Enterprise / Multinational Corporation
100+ AI servers, complex topology, multiple data centers. Shield supports:
- HA Clustering — SHSP, SSRP, SMRP protocols
- Geographic replication — rule sync across regions
- SIEM integration — all events in your SOC
- 21 custom protocols — full traffic control
6 Specialized Guards
| Guard | Protection |
|---|---|
| LLM Guard | Prompt injection, jailbreak |
| RAG Guard | RAG poisoning, SQL injection |
| Agent Guard | Agent manipulation |
| Tool Guard | Tool hijacking |
| MCP Guard | Protocol attacks |
| API Guard | SSRF, credential leaks |
Cisco-Style CLI
Yes, just like on a router:
Shield# show zones
Shield# guard enable all
Shield# brain test "Ignore previous"
Shield# write memory
🐉 Strike — Red Team Platform
Test your AI before hackers do.
You spent months building your AI product. Prompt engineering, fine-tuning, RAG pipelines. Everything works. You launch to production.
Then some kid on Telegram finds a jailbreak in 5 minutes.
Strike is what you should have run before launch.
39,000+ Battle-Tested Payloads
Not theoretical examples from papers. Real attacks:
- DAN series — from DAN 5.0 to DAN 15.0, all versions
- Crescendo — multi-turn attacks with gradual escalation
- Policy Puppetry — XML/JSON injection into system prompt
- Unicode Smuggling — invisible characters, homoglyphs, RTL-override
- Cognitive Overload — context flooding with noise
HYDRA — 9-Headed Attack
Why HYDRA? Because you cut off one head — two grow back.
9 parallel agents hit different vectors simultaneously:
| Head | Attack Vector |
|---|---|
| 🎭 Injection | Direct instruction injection |
| 🔓 Jailbreak | Safety alignment bypass |
| 📤 Exfiltration | Data/prompt extraction |
| 🧪 RAG Poison | Context poisoning |
| 🔧 Tool Hijack | Function calling interception |
| 🎭 Social | Model social engineering |
| 📝 Context | Context manipulation |
| 🔢 Encoding | Encoding-based bypasses |
| 🔄 Meta | Attacks on the defense itself |
Who is Strike For?
- 🔴 Red Team — Full AI pentest
- 🐛 Bug Bounty — Vulnerability hunting automation
- 🏢 Enterprise — Pre-production security validation
- 🎓 Researchers — Experimentation base
🦠 Immune — Next-Gen EDR/XDR/MDR
Biological immune system for IT infrastructure.
This is SENTINEL’s most ambitious component. And for now — in alpha.
The Idea
Why "IMMUNE"? Because it works like the body’s immune system:
- Self vs non-self recognition — not signatures, but behavioral analysis
- Adaptive response — learns from new threats
- Collective immunity — agents share information
Three Protection Levels
EDR (Endpoint Detection & Response) Agent on every host. 6 syscall hooks in the kernel. Sees everything: execve, connect, bind, open, fork, setuid. Not userspace monitoring that can be bypassed — kernel.
XDR (Extended Detection & Response) Cross-agent correlation. One agent sees a suspicious connect. Another — a strange exec. Separately — nothing. Together — lateral movement. HIVE collects and correlates.
MDR (Managed Detection & Response) Automated response playbooks. Detect → Isolate → Alert → Forensics. No waiting for a SOC call.
Connection to SENTINEL AI Components
Here’s where the magic is: Immune isn’t alone. It’s connected to Brain, Shield, Strike:
┌─────────────────────────────────────────────────┐
│ SENTINEL │
├─────────────────────────────────────────────────┤
│ IMMUNE (infra) ←→ BRAIN (detection) │
│ ↓ ↓ │
│ Syscall hooks Prompt analysis │
│ Kernel events Semantic threats │
│ ↓ ↓ │
│ └──→ HIVE (correlation) ←──┘ │
│ ↓ │
│ Unified Threat View │
└─────────────────────────────────────────────────┘
Attack on an AI server? Immune sees anomalous process. Brain sees strange prompts. Correlation gives the full picture: who, from where, through what.
Current Status: Alpha
| Ready | In Development |
|---|---|
| ✅ Agent + KMOD (DragonFlyBSD) | 🔄 Linux kernel module |
| ✅ 6 syscall hooks | 🔄 Windows ETW integration |
| ✅ HIVE correlator | 🔄 Cloud-native agent |
| ✅ Basic playbooks | 🔄 ML-based anomaly detection |
110KB binary. Pure C. Ready for battle — waiting for your contribution.
🔗 Links
- GitHub: DmitrL-dev/AISecurity
- PyPI:
pip install sentinel-llm-security - Colab Demo: Try Strike
📝 Update Log
UPD 1 — 2026-01-06: Shield 100% Production Ready
Shield reached 100% production readiness:
- 103 tests passing (94 CLI + 9 LLM integration)
- 0 compiler warnings
- Valgrind CI: 0 memory leaks
- Brain FFI: HTTP + gRPC clients
- Kubernetes: 5 production manifests
Next: SENTINEL-Guard LLM fine-tuning
⭐ Stay Updated
This article is updated with every major release. Star the repo!
📧 chg@live.ru | 💬 @DmLabincev
Made with 🛡️ by a solo developer from Russia