RiskVoid
DevSecOps for AI agents

Find the vulnerabilities in your AI agents before production.

RiskVoid analyzes the source of your LangGraph, LangChain and CrewAI agents to identify security-relevant components, data flows, trust boundaries, and candidate risk paths. Findings are linked to code evidence, analysis coverage, and remediation guidance.

Analyze your agentTake the free health checkSee how it works

Not ready to connect code? Start with a 2-minute AI security posture snapshot.

Built for
LangGraphLangChainCrewAI
The stakes

The agents your team is shipping are the new attack surface.

80% of companies running AI agents have had one take an unintended action in the last year. Runtime tools see the behavior after it happens. RiskVoid finds the code paths that make the behavior possible, before the agent ships.

80%
of organizations have had an AI agent take an unintended action.
Source: SailPoint, 2025.
$4.44M
average cost of a data breach globally. In the US the figure is $10.22M.
Source: IBM Cost of a Data Breach, 2025.
44%
of organizations have a security policy in place for AI agents.
Source: Technology sector survey, 2025.
Where we fit

Catch it in the pull request, not in production.

Runtime firewalls block attacks as they happen, after your agent has already been built with the vulnerability baked in. RiskVoid is the other half of the SDLC: we analyze the code so candidate risks can be reviewed before deployment.

Commit

Write agent code

Pull request

RiskVoid analyzes diff

Security-oriented model of detected prompts, tools, and candidate paths.

Pre-deploy

RiskVoid grades the build

Source-analysis report with evidence, coverage, and remediation guidance.

Runtime

Guardrails / firewalls

Blocks the request after the vulnerability is already in production.

Incident

Logs & post-mortem

RiskVoid · shift-left

Analyzes the source

  • Runs on every PR, before merge
  • Points at the exact file, line, and patch
  • Zero traffic impact, no inference hop
  • Can enforce policy on new critical findings
Runtime guardrails

Filters live traffic

  • × Observes or blocks behavior at runtime
  • × Adds latency to every single request
  • × Does not replace pre-deployment code review
  • × Requires production telemetry or enforcement

Use both. Pre-deployment analysis reduces avoidable weaknesses, while runtime controls cover behavior that source analysis cannot establish.

What RiskVoid finds

Trace candidate paths from untrusted input to privileged tools.

RiskVoid models security-relevant flows supported by source evidence and flags candidate paths where untrusted data may reach a sensitive operation without an expected check.

Analyzed files
services/agent.py2
tools/refund.py1
graph.py
prompts/system.md
services/agent.py
tools/refund.py
graph.py
12 from langgraph.prebuilt import create_react_agent
13 from .tools import issue_refund, escalate
14
15 def handle_ticket(ticket_id):
16   ticket  = crm.fetch(ticket_id)        # untrusted
17   context = vector_db.search(ticket.body) # untrusted
18
19   agent = create_react_agent(
20     model="claude-sonnet-4",
21     tools=[issue_refund, escalate],22   )
23
24   return agent.invoke({25     "messages": [("user", ticket.body)],26     "context": context,27   })
Line 21–27: untrusted ticket.body and context reach issue_refund with no sanitizer in between.
Data-flow trace
source
ticket.body
crm.fetch() · untrusted
↓
prompt
user message
agent.invoke() · line 25
↓
sink · privileged
issue_refund()
no confirmation · no auth check
critical
RV-2048 · CWE-1427 · OWASP LLM01
Threat modeling

Put findings in system context.

RiskVoid groups related source evidence into candidate risk paths: the likely entry condition, affected components, and security-sensitive operation. These paths are analysis hypotheses for review, not proof that an exploit will succeed at runtime.

criticalRisk path 01

Indirect prompt injection via RAG

  1. attackerPlants instructions in a document the agent will retrieve.
  2. agentRetrieves the document and inlines it into its prompt context.
  3. sinkMay reach issue_refund() without a confirmation check.
Impact

Potential unauthorized refund if the candidate path is reachable at runtime.

highRisk path 02

Tool-confused-deputy via shared session

  1. attackerSends a low-trust message that overlaps with an admin task.
  2. agentReuses an open admin session token while resolving the request.
  3. sinkMay reach an admin-only write without an authorization check.
Impact

Potential privilege crossing between user contexts in a shared session.

mediumRisk path 03

Cost-amplification loop

  1. attackerSubmits a recursive task that the planner cannot terminate.
  2. agentRe-enters the tool loop with no recursion_limit set.
  3. sinkMay repeat model and tool calls without an explicit bound.
Impact

Potential quota exhaustion or cost amplification if runtime limits are absent.

Example findings

Findings grounded in source evidence.

Each finding points to the relevant file and line, the observed code pattern, and remediation guidance. Coverage indicates what the available source can support.

criticalRV-2048
Prompt injection via RAG

Untrusted retrieved docs reach issue_refund() with no confirmation

Retrieval context is concatenated into the agent's state. Untrusted content may influence a sensitive tool call when confirmation and authorization checks are absent.

services/agent.py:21 · CWE-1427
highRV-1917
SSRF via HTTP tool

HTTP tool accepts arbitrary URLs; env vars reachable via code tool

No allowlist on http_get. Untrusted URL construction may reach unintended hosts, while the code tool exposes environment access.

tools/http.py:41 · CWE-918
mediumRV-1703
Unbounded tool loop

Graph has no recursion limit; cost-amplification vector

LangGraph recursion_limit is unset. A single user turn can trigger hundreds of tool calls, blowing quota and provider cost.

graph.py:12 · RV-POLICY-04
What we analyze

Coverage across agent security surfaces.

Findings map to relevant OWASP LLM Top 10 and CWE references. Support varies by language, framework, and available evidence, and reports state analysis coverage.

Prompt and instruction injection

OWASP LLM01
  • Direct prompt injection in user input
  • Indirect injection via retrieved documents
  • Tool-output injection from upstream calls
  • System-prompt override through templated context

Privileged tool exposure

OWASP LLM06 · CWE-1427
  • Privileged sink reachable from untrusted source
  • Missing confirmation on destructive actions
  • Tool registered with no authorization check
  • Over-broad tool scopes (filesystem, shell, code)

Data exfiltration paths

OWASP LLM02
  • Secrets reachable from tool output back to model
  • Unscoped HTTP / fetch tools (SSRF, callback exfil)
  • PII forwarded to third-party services
  • Markdown / image rendering as exfil channel

Agent control flow

OWASP LLM10
  • Unbounded recursion in graph or planner
  • Missing checkpointer / interrupt boundaries
  • Conditional edges that bypass review nodes
  • Delegation chains across agents with no guardrail

Model and supply chain

OWASP LLM05 · LLM07
  • Hardcoded credentials in agent definition
  • Pinned model providers without fallback policy
  • Untrusted plugin / tool packages
  • Outdated framework versions with known CVEs

Operational hardening

RiskVoid policy
  • No structured logging on tool calls
  • No rate limiting on agent invocation
  • PII not redacted before model call
  • No explicit budget on model or tool execution
EU AI Act · compliance

If your agent is Annex III, you have a deadline.

Under the EU AI Act, agents used for employment decisions, credit scoring, or access to essential services qualify as Annex III high-risk. The August 2026 deadline is the date by which your deployed system has to meet the risk management, documentation, and human oversight obligations. RiskVoid produces the artifact your auditors will ask for.

HR and talent agents.

Annex III, point 4.

Screening, ranking, promotion, and termination decisions fall under employment discrimination law across every Member State.

Fintech agents.

Annex III, point 5(b).

Creditworthiness evaluation and credit scoring require documented risk controls and residual risk disclosure.

Legal tech agents.

Annex III, point 8.

Agents involved in the administration of justice require documented oversight and the ability to explain outcomes.

Education and EdTech agents.

Annex III, point 3.

Admissions decisions, learning-outcome assessments, and exam conduct monitoring require documented fairness controls and a path for students to contest automated outcomes.

Insurance agents.

Annex III, point 5(c).

Life and health insurance risk assessment and pricing require documented bias controls and an explainable basis for every rating decision.

The product

Install the GitHub app. Get a dashboard.

Engineers see findings in their pull requests. Security and compliance leads see the full posture across every agent repo in the dashboard. Both views update in real time.

Install on GitHub

Read-only · org-scoped · 2 min

  1. 1
    Install RiskVoid on your org
    One-click install. Pick which repos we see; everything else stays invisible.
  2. 2
    We detect your agents
    LangGraph, LangChain, CrewAI imports and graph definitions are indexed automatically.
  3. 3
    Every PR gets a review comment
    New criticals block merge. Fixed findings close automatically on the next commit.
RV
riskvoid commented on #1284 · 2 min ago
1 new critical0 new highgrade: F ← D
New finding at services/agent.py:21: untrusted ticket.body can reach issue_refund(). Blocking merge per org policy.
View reportSuggest patch
riskvoid.io/dashboard · acme-corp
Organization posture

acme-corp

D
Critical3
High9
Agents14
PRs today7

Recent analyses

14 repos
F
acme/checkout-agent
main · 2m ago · PR #1284
1 crit
C
acme/support-copilot
main · 1h ago
3 med
A
acme/sales-researcher
main · 3h ago
clean

Pull request reviews.

The GitHub App runs on every PR, posts findings as inline comments, and can block merges that violate policy.

Security posture dashboard.

One view of every repo, every open finding, every policy violation, with trends by severity and by surface.

Policy controls.

Security leads set the bar once. The platform enforces it on every change, in every repo, without engineering having to opt in.

Notifications where you work.

Slack for the engineering channel, email digests for the security and compliance leads.

How the analysis works

Source in. Graph out. Findings opened.

RiskVoid performs pre-deployment source analysis. It models detected components and supported relationships without executing your production agent or adding an inference hop to production traffic.

Step 01

Clone & index

Read-only source access. Framework imports and agent entry points are detected automatically.

Step 02

Build the security model

Detected agents, prompts, tools, resources, and supported relationships are represented with source evidence.

Step 03

Analyze candidate paths

Rules and data-flow analysis evaluate supported paths and retain evidence, confidence, and coverage.

Step 04

Review and remediate

Review findings with code locations and remediation guidance, then rerun analysis after changes.

Supported frameworks

Deep support for the frameworks teams ship with.

Not a long list of logos. Native graph extractors for LangGraph, LangChain, CrewAI, and n8n: the frameworks behind the agents we see in the wild.

LangGraph

Native support
  • StateGraph & MessageGraph nodes parsed
  • Conditional edges traced through reducers
  • Prebuilt create_react_agent analyzed
  • Checkpointer & interrupt coverage

LangChain

Native support
  • LCEL chains & Runnable composition
  • Agent executors & tool registration
  • Retriever → prompt → LLM flow graphs
  • Custom @tool definitions

CrewAI

Native support
  • Crew, Agent & Task definitions
  • Delegation paths between agents
  • Tool inheritance across roles
  • Sequential & hierarchical process modes

n8n

Native support
  • Workflow JSON parsed node by node
  • AI Agent & LLM node inputs traced
  • HTTP, Code, and tool-call nodes graphed
  • Credentials and webhook exposure checks
Free AI Security Health Check

Find your AI security posture in 8 questions.

A fast maturity snapshot for teams using AI tools, RAG apps, copilots, or agents that touch real business workflows.

2 minutesNo email for scoreService-fit recommendation
Q1

Do you know where AI is used across the organization?

Tools, agents, copilots, RAG apps, workflow automations, and shadow usage.

Q2

Can sensitive data enter any AI system?

Customer records, PII, legal files, financial data, source code, or regulated data.

Q3

Do AI systems use internal documents, databases, or RAG?

Anything that retrieves company or customer data into model context.

Q4

Can any AI system call tools, APIs, or workflows?

CRM, Jira, Slack, email, databases, browser actions, MCP tools, or no-code workflows.

Q5

Can AI write, send, update, or trigger actions?

Tickets, records, messages, emails, webhooks, database updates, or business workflows.

Q6

Are permissions and approvals enforced outside the prompt?

Backend checks, policy engines, tool wrappers, or approval tokens before execution.

Q7

Do you know where prompts, retrieved data, and tool calls are logged?

Trace providers, cloud logs, model outputs, retrieved chunks, and retention rules.

Q8

Has a customer, auditor, investor, or executive asked about AI security?

Any external or leadership pressure to explain how AI risk is controlled.

FAQ

Everything you'd ask a security engineer on day one.

Do you need access to my production traffic?01
No. RiskVoid performs pre-deployment source analysis and does not sit in the production inference path. The analysis uses repository structure and code evidence rather than production traffic.
How is this different from a runtime firewall?02
Runtime firewalls block requests as they arrive, after the vulnerability has already been written, reviewed, and deployed. RiskVoid analyzes the source to stop the vulnerability from shipping in the first place. Use both; they live in different parts of the SDLC.
How is this different from a general SAST tool?03
RiskVoid adds agent-aware modeling for prompts, tools, resources, and supported relationships. It identifies candidate security-relevant flows under explicit analysis coverage instead of treating the graph as a complete runtime trace.
What's the feedback loop with my repo?04
The GitHub App can analyze selected repositories and pull requests. Findings link back to source evidence and remediation guidance, and a later analysis can show whether the relevant code pattern remains.
Which severity scale do you use?05
Five levels (critical, high, medium, low, and informational), mapped to CVSS 3.1 and OWASP LLM Top 10. Overrides are configurable per repo.
Do you need my runtime secrets?06
No. Do not provide runtime secret values. RiskVoid analyzes source and configuration structure; secret references may be identified as evidence without requiring production credentials.

Your agents have capabilities. Do you know their risks?

Install the GitHub app. Get your first analysis on your next PR.

Analyze your agentTake the free check