Introducing sentinel

Published on August 11, 2026

Last month we released Sentinel-R2.1, a model trained on authorized penetration-testing trajectories. A model that reasons about security work still needs somewhere to do it — a loop that calls tools, a place those tools can run safely, and an operator in the approval path.

Today we're releasing that harness. sentinel is a red-teaming agent for the terminal, and every command it runs happens inside a container it cannot escape.

Point it at a codebase and it maps the attack surface, audits for vulnerabilities, proves exploitability against targets you have put in scope, red-teams LLM applications against the OWASP LLM Top 10, writes detections mapped to MITRE ATT&CK, and hands back a report with severities and evidence.

Not a Scanner's Checklist

sentinel gets there the way an operator does: reading the code, running commands, writing probes and proofs-of-concept. It has real file and shell tools rather than a fixed rule set — nineteen of them, across files and shell, a task list, subagents, and event sources like Monitor and the schedulers that can wake the loop when a background scan reports back.

It is built as a ReAct loop directly on the openai SDK. No LangChain, no agent framework: the loop, the tool protocol, the context management, the subagent registry, and the approval gate are all in code you can read. Tool calls use the model's native function-calling interface, so actions are structured JSON rather than prose the harness has to parse.

The offensive work is scoped for authorized engagements with defined rules of engagement, and the agent briefs say so — the exploit subagent is instructed to stop and report rather than proceed when the target or the authorization is unclear.

The Subagent Registry

The security work lives in the subagents. Each one is a second ReAct loop with its own context window and a narrower toolset, and it reports back a single string — so the parent pays for the conclusion rather than the whole exploration.

• recon (read-only) — map services, endpoints, routes, dependencies, exposed secrets, trust boundaries. Enumerate, do not exploit.
• vuln (read-only) — audit for injection, broken access control, auth and session handling, hard-coded secrets, unsafe deserialization, SSRF, and crypto misuse, with severity, file:line, data flow, and an exploit scenario per finding.
• exploit — a minimal proof-of-concept against an in-scope target to confirm exploitability. Nothing weaponized, destructive, or persistent.
• llm-redteam — prompt injection, jailbreaks, system-prompt and training-data leakage, insecure output handling, excessive agency. It writes the probes, runs them, and scores what succeeded.
• detect — author detections in Sigma, YARA, or the project's own format; hunt for IOCs; map findings to ATT&CK techniques and D3FEND countermeasures.
• report — executive summary, then each finding with a CVSS-style severity, evidence, reproduction, impact, and remediation.

Two general-purpose types, explore and code, back them up for the reading and the fixing that security work turns into. None of them get the Agent tool, so subagents cannot spawn further agents.

Confinement Is the Feature

An agent doing this work runs hostile input through your machine all day. So the sandbox is not a disclaimer at the bottom of the README.

Commands run in a container via podman, docker, or nerdctl, with the image pinned by digest rather than by tag. The workspace is bind-mounted at its own absolute path so paths in output stay correct — and nothing else is mounted. $HOME, ~/.ssh, and the rest of the machine simply are not there. Capabilities are dropped, resources are capped, and the container's own root filesystem is immutable, so a command cannot shim the tools whose output the agent later trusts.

Egress is allowlisted by default. The container sits on an internal network with no route out; its only path to the internet is a proxy permitting a starter list of package and source hosts. Enforcement is the network rather than HTTP_PROXY, so unsetting the proxy variables and opening a raw socket gets "network is unreachable" rather than a connection.

Around that:

• Approval before mutation. Writes, edits, and shell commands prompt with a diff or the command itself. A denial is final — it goes back to the model as an observation, with instructions not to work around it.
• Unrecoverable commands are refused outright, not merely prompted.
• Paths cannot escape the workspace. ../, absolute paths, and symlinks pointing out are resolved on disk, not read as text.
• Tools do not inherit your credentials. Anything credential-shaped is stripped from the environment they get, including the key the agent itself runs on.
• A repository cannot configure its way to execution. hooks, statusLine, env, permissions.allow, sandbox, baseURL, and providers are ignored in a project's own settings files — a target you cloned to audit does not get to weaken its own confinement.

Monitored output arrives fenced and labelled untrusted, because it came from outside: it is data, not instructions.

The Model It's Built Around

sentinel drives any OpenAI-compatible endpoint that streams tool calls, and a frontier general model works well. But it is named after, and designed for, glyphsoftware/sentinel-r2.2 — the next generation of our offensive-security model.

R2.2 is a Gemma 4 26B-A4B sparse MoE: 128 experts with top-8 routing, roughly 25.8B total parameters but only about 4B active per token, and a context window of up to 262,144 tokens. The active-parameter count is the practical headline — 26B of capacity to draw on at roughly the inference cost of a 4B dense model, which is what makes a long agentic loop affordable to run locally.

It was trained on sentinel-exploit-db: HTB-style machine pentests, CTFs, real CVE chains, Active Directory, cloud and database engagements, V8 exploitation, and ATT&CK-mapped red-team lifecycles. That is the same shape as a sentinel turn — reason, call a tool, read the result, iterate — so the loop and the weights want the same thing.

Read the model card's own limitations before leaning on it. The training set is a specialized 551-conversation slice rather than a broad capability upgrade, it skews toward Linux boxes and web and service CVEs, and no end-to-end engagement success rate against real targets has been published. It is an aid to a skilled operator, not a replacement for one.

Getting Started

On macOS and Linux:

curl -fsSL https://raw.githubusercontent.com/Glyph-Software/sentinel/main/install.sh | sh

On Windows:

irm https://raw.githubusercontent.com/Glyph-Software/sentinel/main/install.ps1 | iex

Either one downloads the build for your platform, verifies it against SHA256SUMS.txt, puts sentinel on your PATH, and pulls the sandbox image. It ships as a single standalone binary for macOS (arm64/x64), Linux (arm64/x64), and Windows (x64).

Then:

sentinel "map the attack surface of this service"

There is nothing to configure first. The first run opens /provider: pick an endpoint — OpenAI, Anthropic, OpenRouter, Azure, Bedrock, Ollama, LM Studio, vLLM, or anything OpenAI-compatible — and give it a key, which is encrypted into ~/.sentinel/secrets.db. Several profiles coexist, and --provider <name> switches between them in a word. No key is ever read from .env or your shell environment, deliberately.

For non-interactive use, -p puts progress on stderr and the answer on stdout with no approval prompts:

sentinel -p "audit the auth middleware for broken access control" > findings.md

Sessions save after every turn, so --continue picks up where you left off and an engagement can run across days.

Where It Stands

sentinel is at 0.0.3-ALPHA. The loop, the tools, the sandbox, and the subagent registry are all in place and covered by 419 tests, but this is early software doing consequential work — treat its findings as hypotheses to verify, and run it only against systems you are authorized to test.

The docs go deeper than this post can: architecture, tools, safety, configuration, and sessions. The safety document in particular is worth reading before you trust it with anything.

For licensing, model access, or security inquiries, contact Glyph Software.