# Introducing BloodHound: WarHoundAI’s Security Agent > BloodHound represents WarHoundAI’s vision for an autonomous application security agent. This article details the context-driven problem it addresses, the bounded check workflow, and the current capabilities available through Mini Hound. Official source: https://warhoundai.com/blog/introducing-bloodhound/ Published: 2026-10-19 Author: WarHoundAI Updated: 2026-11-12 ## Security Needs Context Over Isolated Alerts A web application is a complex collection of decisions governing identity, access control, routing, and data storage. Applications often present a polished interface while underlying security boundaries remain poorly defined. Accelerating software delivery does not eliminate the requirement to meticulously review these boundaries. BloodHound is being designed to investigate applications with deep structural context rather than merely matching signatures. The intended role of the agent is to connect publicly reachable endpoints with actual demonstrable checks, ultimately providing developers with actionable insights. This approach aims to replace lists of unexplained security warnings with a transparent, understandable security workflow. ## Mini Hound and Current Availability While the full standalone BloodHound agent remains in development, WarHoundAI currently offers Mini Hound to evaluate foundational agentic workflows. Mini Hound operates using Gemini 3.8 Flash for v1 assessments, and Gemini 3.1 Pro preview through Google Cloud for Pro assessments. Access to Mini Hound is structured through two plans. The Free plan provides one dollar in expiring monthly credits for v1 model access. The Plus plan, priced at four dollars and ninety-nine cents per month, provides five dollars in expiring monthly credits and allows selection between both models. Credit consumption charges at exactly twice the actual provider token cost, accounting for reasoning overhead. The customer MCP includes account-scoped browser, search and fetch tools; deployment and service configuration determine availability. All operations currently require a verified origin to ensure target authorization. ## Worked Example: Bounded Cross-Tenant Export Check To illustrate how an agent investigates application logic, consider a bounded isolated browser check targeting a multi-tenant financial application. The objective is to verify that an authenticated user cannot access data exports belonging to another organization. The agent receives configuration credentials for synthetic Tenant A and the identifier for an export belonging to synthetic Tenant B. The agent navigates to the application, authenticates as Tenant A, and directly requests the export route for Tenant B. The expected secure outcome is an HTTP 403 Forbidden response or a deliberate redirection preventing access. If the application returns an HTTP 200 OK along with the sensitive data payload, the agent captures this evidence to formulate a valid candidate finding. This check strictly operates within owner-configured synthetic environments. It explicitly requires predefined state and authorized credentials to prevent the agent from indiscriminately probing unverified production targets. ## Execution Budgets and Test Matrix Agent behavior is constrained by hard execution budgets categorized as low, medium, high, and max. These limits determine how many iterative reasoning steps the agent may perform before halting, preventing runaway token consumption. The following matrix defines expected allowed and denied outcomes based on budget configuration and scope limitations. - Low Budget: Allowed to perform single-step verification on explicitly provided URLs. Denied from performing recursive discovery or multi-step authentication flows. - Medium Budget: Allowed to navigate standard login portals using provided credentials. Denied from brute-forcing rate-limited endpoints or exhausting secondary application states. - High Budget: Allowed to evaluate complex authorization state changes across multiple roles. Denied from exceeding hard execution token limits or testing out-of-scope third-party identity providers. - Unverified Origin: Denied entirely. All plans and budgets require origin verification before any synthetic retest is initiated. ## Implementation Tradeoffs and Failure Modes Deploying an autonomous security agent introduces specific implementation tradeoffs. Utilizing an LLM-driven agent for bounded browser checks increases latency and compute costs compared to static signature scanning. Organizations must weigh the precision of context-aware findings against the overhead of reasoning token consumption. Failure modes commonly involve agent hallucination during complex application state navigation. An agent might incorrectly interpret a generic error page as a successful authentication bypass if the DOM structure resembles a protected dashboard. Additionally, overly restrictive execution budgets can force the agent to halt prematurely, resulting in incomplete assessments and false negative reports. To mitigate these risks, all candidate findings are surfaced for human validation. The agent provides the exact sequence of HTTP requests and browser actions taken, ensuring that no claim is accepted without reproducible evidence. ## Explicit Limits of Agent Evidence An AI-generated security review or synthetic retest is not proof that a system is secure. WarHoundAI does not provide blanket security guarantees. The absence of a finding simply indicates that the agent, operating within its configured execution budget and model constraints, did not identify a vulnerability in the explicitly defined scope. Furthermore, WarHoundAI does not perform automatic code changes or deploy patches directly to production environments. Suggested remediations require mandatory human review. The agent cannot anticipate all downstream operational impacts of modifying an application's permission model, and manual regression testing remains a necessary requirement for responsible remediation. ## Developer Workflow Integration via MCP Security context is most valuable when integrated directly into the environments where software is constructed. WarHoundAI provides an authenticated endpoint at /api/mcp to facilitate Model Context Protocol integration for compatible AI assistants. Through this endpoint, entitled accounts can manage targets, retrieve reviews, and initiate synthetic retests programmatically. This ensures that the insights generated by Mini Hound are accessible during the active development phase, supporting a continuous feedback loop rather than a delayed audit cycle. ## Sources and Acknowledgments For the most current information regarding product availability, execution budgets, and API integrations, please consult the official WarHoundAI product overview. Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results. Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results. - [BloodHound product overview and availability](https://warhoundai.com/bloodhound/) - [About WarHoundAI and its mission](https://warhoundai.com/about/)