Secure · Agent Security
A finding is any breach of the limits and frameworks you adopted: personal data or secrets sent to an AI app, a limit crossed, a red-team check failed, a verdict from your own pipeline. Lustena detects them on the device and in your stack, without content leaving either, and keeps them in one inbox with a lifecycle.
Works with
ChatGPTClaudeGeminiCopilotClaude CodeCursorCrewAILangGraphWithout a control plane On the control plane
Data exposure
Without a control plane: Customer lists, contracts and credentials are pasted into AI apps with nothing in the path to notice and no record of what moved.
On the control plane: Every prompt, paste and upload is classified on the device against a catalog of personal data and secrets, and flagged as it is sent.
Shadow AI
Without a control plane: Any employee can create a GPT or connect a drive to an AI app in minutes. There is no inventory and no review.
On the control plane: Every app, GPT, project and connector in use appears in the inventory with an owner, as it is used, without content leaving the device.
Agent weaknesses
Without a control plane: Code-built agents ship without anyone trying a prompt injection, a leaked system prompt or a poisoned tool result.
On the control plane: The scanner runs ten agent-native checks against an authorized endpoint and attaches the report to the agent in the inventory.
Data exposure
01Where the agent acts · browser
02Lustena, in the path
Agent session
liveSubject
Verdicts
03Systems reached
Gmail
connector
Drive
connector
HubSpot
connector
Classification on the device, limits on every session, red-team scans on demand, and findings that reach the people who can act.
Twelve recognizers run in the browser: email addresses, card numbers, API keys, JWTs and private keys, plus national formats such as Brazil's CPF, CNPJ, RG, CNH, CNS and CEP postal code, plus Brazilian phone numbers. Each hit is one content-free finding.
Findings and sessions are evaluated against the agent's limits. Crossing a limit raises an alert that names the dimension, the observed value and the allowed one.
Point the scanner at an agent you are authorized to test. Prompt injection, system-prompt leak, tool-output injection, MCP supply chain and more, mapped to the OWASP LLM Top 10.
Findings reopen when they recur, close when they are resolved, and reach Slack, your SIEM or a ticket through webhooks. Nothing requires reading a prompt.
On the device
Red-team scans
Coverage
Response
DLP watches files, CASB watches SaaS logins, the proxy watches encrypted traffic. None of them reads a paste into a chat box. The browser is where the agent acts, and it is where Lustena classifies.
Outside the loop · where legacy controls sit
No line of sight inside
Inside the loop · where Lustena sits
The agent loop runs here: prompt, model, tool, result. Readable only on the device.
Questions
No. Classification runs on the device and only categories, counts, destinations, channels and HMAC fingerprints leave it. Content capture is off by default, requires a written lawful basis, is redacted on the device and audited on every read.
An endpoint you are authorized to test and, if it is behind a token, the header it expects. Credentials are referenced by environment variable name, never pasted into a conversation.
By default Lustena observes: it records findings and raises alerts. On the Enterprise plan it can warn, block or redact, chosen per data class and per team.