Meet Cerberus: How the Ledger Donjon Built an AI Security Harness

Before You Dive In:

• AI is lowering the cost and raising the speed of cyberattacks. Security teams need their own AI capabilities to keep pace.
• Ledger CTO Charles Guillemet has written on ‘How AI is rewriting the economics of security’
• The Donjon built Cerberus as a coordinated team of six specialized agents, each with a distinct role in finding, verifying, and fixing security flaws.
• Cerberus has already been used to uncover real vulnerabilities in widely used open-source software, leading to responsible disclosure with each affected project.

How AI Changes the Rules of Security

Cyberattacks have always been a numbers game. The more targets an attacker can probe, the better their odds of finding a way in. For years, that meant attackers needed to balance finite resources, time, and expertise in deciding how to run serious offensive operations.

AI is changing that calculation. It reduces the cost of attacks, increases the speed at which vulnerabilities can be discovered, and lowers the barrier to entry for anyone looking to cause damage. A motivated attacker no longer needs a large team. They need the right tools, and those tools are increasingly accessible. The market for offensive resources has crashed to the point where the price of vulnerabilities is trending toward zero.

The price for vulnerabilities is literally trending to zero… https://t.co/lRnX0xtFuv

— Charles Guillemet (@P3b7_) July 23, 2026

For a security team, there is only one reasonable response: build your own defensive AI capabilities. That is exactly what the Ledger Donjon set out to do.

What Is Cerberus?

The Ledger Donjon is Ledger’s in-house security research team, a group of specialists whose job is to find weaknesses in Ledger’s own products and the wider software ecosystem before real attackers do. Cerberus is the AI security system the Donjon built to extend that mission.

Cerberus seemed like a suitable name for the system; in Greek mythology it was a huge, terrifying multi-headed hound that guarded the gates of hell and has become a byword for a powerful gatekeeper.

The most important thing to understand about Cerberus is what it is not. It is not simply a powerful AI model pointed at a codebase. As the Donjon team puts it.

“A prompt is not an agent. A raw AI model is, at its core, a function. You put something in, you get something out. Without the right engineering around it, it stops too soon, drifts off course, or produces plausible-sounding answers that fall apart under scrutiny.”

Cerberus is the system built around the model. It’s a structure that gives it memory, tools, a task backlog, a budget, and the ability to iterate until it reaches a real conclusion. It turns a capable AI model into something that can do genuine security work.

Meet the Team

Cerberus works as a team of six specialized agents, each with a distinct role. They pass work between each other through a shared task system, not unlike a security team operating across a shared project board. A human is always in the loop, overseeing the process and making final calls.

Striker –  Penetration Testing Agent 

It explores a codebase or system the way a penetration tester would, probing for weaknesses and mapping out potential attack surfaces. Where a human pentester might spend days on this phase, Striker runs continuously.

Sentinel – Code Review Pipeline Manager 

It reviews code systematically, looking for security issues across the codebase. It also re-reviews every patch that Merlin (the Patch Wizard – see below) produces, closing the loop on fixes before they ship.

Jarvis – Finding Triage Analyst 

Security scans generate noise. The same issue can surface multiple times, described differently on each pass. Jarvis deduplicates, groups related findings, and keeps the knowledge base coherent so the team is working from a clean, prioritized picture of what actually matters.

Vecna – End-to-End Exploitation Agent 

A reported vulnerability and a confirmed vulnerability are two different things. Vecna attempts to actually reproduce the issue, building a working proof of concept to confirm that the flaw is real, exploitable, and fully understood before it gets escalated.

Hopper – Live Challenge Assistant 

Named after computing pioneer Grace Hopper, this agent challenges conclusions in real time. When another agent flags a potential vulnerability, Hopper stress-tests the reasoning: Is this finding solid? Could it be a false positive? Is the severity right? It is the system’s built-in sceptic.

Merlin – Patch Wizard 

Once Vecna confirms a vulnerability is real, Merlin generates a patch, opens a pull request, monitors the CI pipeline, and adjusts if anything fails. Its work then goes back to Sentinel for independent review before anything is marked done.

Together, the loop runs: find, review, sort, challenge, prove, fix, re-check, with a human supervising every step.

Real Results

A system like this is only worth building if it finds real vulnerabilities. Cerberus does.

Since deployment, the Donjon has used Cerberus to surface confirmed security flaws in widely used open-source projects, following responsible disclosure with each affected team. For issues that are realistically exploitable, the Donjon reports privately and coordinates with the project before going public. For lower-impact issues, they open public issues or pull requests so fixes can happen in the open.

The confirmed findings include vulnerabilities in Yubico’s YubiKey authentication libraries, KDE’s Kleopatra security software, and Sandboxie-Plus, a widely used sandboxing tool. Four of these findings have been assigned CVEs, the industry-standard identifiers used to formally track and communicate security vulnerabilities. The issues span multiple programming languages and vulnerability types, from privilege escalation on Windows to authentication bypass in cloud infrastructure.

Part of the disclosure is published at github.com/Donjon-Cerberus.

What This Means for the Ecosystem

The work of the Ledger Donjon extends well beyond Ledger’s own products. By stress-testing the wider software ecosystem and disclosing what it finds, the team contributes to raising security standards across the industry. The vulnerabilities Cerberus surfaces in third-party software are fixed before attackers can exploit them, protecting far more than just Ledger users.

The recent Coldcard vulnerability highlighted how high the stakes are for ongoing security vigilance. Ledger CTO Charles Guillemet wrote an in-depth assessment of how Coldcard seeds were exploited, highlighting the role AI plays in how the Donjon hunts for vulnerabilities in our own products, and its genuine effectiveness. 

For anyone in the Ledger ecosystem, the Donjon is the team behind the security model you rely on every time you verify a transaction on your Ledger signer. Cerberus is the latest evolution of that commitment.

Security has always been a long game. The Donjon is not waiting for it to change.

For the full technical detail on how Cerberus works, including the architecture, agent design, and engineering decisions behind it, read the original post on the Ledger Donjon blog.