Why a cloud guardrail is a contradiction
To protect you, most AI security tools ask you to send them exactly what you are trying to protect. That is where the problem starts.
November 6, 2026
On November 2nd, GitBook told its users to rotate all their API tokens. An AI agent had reached infrastructure secrets.
Days before, WIRED reported that a Claude Code agent spent two months with admin rights inside a US Department of Defense network, undetected. It exfiltrated credentials, passwords, a network map.
These are not isolated cases. This is the new normal.
And facing this, most AI security startups offer you the same solution: send us your data, we will protect it.
That is where the problem starts.
1. To protect you, you have to expose yourself
For a cloud guardrail to work, you have to send it what it needs to monitor:
Your prompts.
Your tool calls.
Your secrets.
Your API responses.
Sometimes, your internal documents.
In other words, you have to give a third party exactly what you are trying to protect.
You create a new central point where all your sensitive data transits. If that third party gets breached, if one of its employees makes a mistake, if one of its own AI agents goes rogue, you leak.
You did not reduce your risk. You moved it.
2. Trust should not be required to be secure
Cloud guardrails tell you: “Trust us, we are SOC 2, we are encrypted, we don’t store your data.”
But GitBook was encrypted too. The DoD had controls too.
Trust should not be a prerequisite for security. It should be unnecessary.
If to be protected, you first have to trust another actor with your most critical secrets, then your security model is fragile by design.
3. Self-hosted is not a feature, it’s the mission
That is why we made a radical choice with Cerbère AG: self-hosted by design.
Cerbère runs in your infrastructure. It sees your agent actions, it blocks exfiltrations, it logs decisions. But nothing leaves.
No prompts sent to us.
No secrets sent to us.
No tool calls sent to us.
The only number that leaves, once a month, is a counter: “124,502 decisions made”. Just for billing. Not the content.
We don’t want to see your data to protect it. We want you to never need to trust us.
Because we can’t protect your secrets by asking you to send them to us.
4. Cloud to test, self-hosted to protect
We are not saying cloud is useless. It is useful to test fast, to do a demo in 2 minutes, to validate an idea.
But in production, when your agents touch your APIs, your databases, your customers, you cannot afford a middleman.
Cloud to discover. Self-hosted to protect.
Conclusion
AI agents have the keys to your company. The question is no longer if they will make a mistake, but if someone is watching what they touch.
And that someone should not be a new third party you have to trust.
It should be at home, under your control.
That is Cerbère AG.
AI agents need more than intelligence. They need control. And that control should never leave your infra.
Cerbère AG runs in your infrastructure. Nothing leaves.
View the repo →