ZeroLeaks is an agent built to secure other agents. It sits at the intersection of AI safety and developer operations, providing a tool for teams deploying LLMs with tool-calling capabilities. Because agents often have access to internal actions—such as sending emails, querying databases, or executing code—a prompt injection is a potential security breach rather than a mere linguistic trick.

By using a multi-agent architecture to conduct its scans, ZeroLeaks represents the next stage of the agent stack: the meta-agent. This is an autonomous system that understands how other agents work well enough to break them and, subsequently, fix them. For developers building in the agent ecosystem, ZeroLeaks provides a way to automate the high-stakes work of red-teaming, ensuring that autonomous systems remain within their intended operational boundaries.

The security of agentic workflows

ZeroLeaks is a security company building an autonomous scanner for LLM-based systems. As enterprises shift from simple chat interfaces to agentic workflows—where AI has permission to call internal APIs, query private databases, and execute code—the attack surface expands significantly. ZeroLeaks focuses on the specific vulnerabilities created by this shift: prompt injection and the unauthorized extraction of system instructions.

Security in the LLM era is distinct from traditional software security. In a standard application, code and data are separate; in an LLM, the instructions (the system prompt) and the user data (the user prompt) are processed in the same context window. This creates an opening for attackers to use natural language to bypass software guardrails. ZeroLeaks attempts to find these openings before they are exploited by simulating real-world attacks using a multi-agent architecture.

The multi-agent probing architecture

The platform operates through a coordinated system of specialized agents. This is a notable departure from traditional security scanners that rely on static libraries of known malicious strings. Instead, ZeroLeaks deploys its own agents to interact with a target system. One agent might act as an adversary, iteratively refining its prompts to discover a bypass for a safety filter. Another agent monitors the output, checking for leaked system prompts or unauthorized tool calls. By mimicking a live attacker, the tool identifies weaknesses that static tests usually miss.

Once a vulnerability is identified, the system moves from detection to remediation. It provides recommendations for prompt adjustments and, in some cases, can autonomously patch the prompt to close the leak. This loop is designed to reduce the time-to-resolution for security teams, who otherwise have to manually red-team their models—a process that is both expensive and slow.

Market position and origins

Founded in early 2025, ZeroLeaks is part of a nascent wave of companies treating AI security as an automated DevOps requirement. The company is small, with a headcount between one and ten employees, reflecting the specialized nature of the team. While larger cybersecurity firms are adding LLM security to their existing suites, ZeroLeaks is purpose-built for the "agent-to-agent" security problem.

The technical foundation of the company involves a deep focus on prompt engineering as a security vector. Their tools are designed for teams that are deploying models with tool-calling capabilities, where a successful injection could lead to more than just a rude chatbot response. If an agent has access to a company's CRM or financial records, a prompt that triggers a data dump is a critical failure. ZeroLeaks treats these system prompts as secrets that require the same level of protection as API keys or database credentials.