Building Argus — Security for AI Agents

Securing the future of AI agents

Co-founder & CEO of Argus. Ex-PDD algorithm engineer. USC researcher. I build open-source security tools that find the vulnerabilities Semgrep and Bandit can't see — prompt injection, credential leakage, trust boundary violations in agent code.

⚡ agent-audit on GitHub GitHub Profile → Get in touch →
★ 134
GitHub Stars
30+
Vulns Found in Top Frameworks
85+
Detection Rules (OWASP Top 10)
6
Community Fix PRs Merged
// About

The short version

Heady Zhang

I find and fix the security gaps that traditional tools can't see. Semgrep and Bandit produce zero findings on agent-specific vulnerabilities. Argus's open-source scanner surfaces the entire category — prompt injection in tool definitions, overprivileged MCP configs, credential leakage, unsandboxed code execution. 85+ detection rules mapped to the OWASP Agentic Top 10.

Before founding Argus, I was a Founding Engineer at Topify.ai, where I built a full end-to-end GEO agent from scratch — the company raised a $1.5M seed and hit $300K in bookings within 3 months. Before that, I was an Algorithm Engineer at PDD (Pinduoduo), working on causal inference and uplift modeling at scale.

I'm pursuing my M.S. in ECE at USC (2025–2027), researching LLM and agent security under Prof. Yue Zhao at the FORTIS Lab. My undergrad is from Shanghai Jiao Tong University (SJTU, ECE, 2022–2025).

The AI agent ecosystem is growing faster than its security infrastructure. Someone needs to build the guardrails. That's what I do.

USC FORTIS Lab SJTU Ex-Topify.ai Ex-PDD Agent Security Causal Inference Static Analysis OWASP Top 10
// Currently Building

Argus

The security platform for AI agent code — Snyk for agents and MCP. We find vulnerabilities that Semgrep and Bandit miss entirely, because those tools were never built for the agent era.

143k+ ★
Combined stars of frameworks scanned
85+ rules
OWASP Agentic Top 10 coverage
7 engines
AST · Taint · MCP · TS · Go · Solidity · Cred
Filed 6 security vulnerabilities in CrewAI (47k★), AutoGen (55k★), LangGraph (26k★), Pydantic AI (15k★) — true positives in every scan
6 of 8 findings received community-submitted fix PRs without us asking — the ecosystem is pulling our work into their codebase
Stanford SNAP Lab (Prof. Leskovec): scanned Biomni agent, found 158 vulns across 8/10 OWASP categories including critical RCE chain
FluxA security audit — 6 repos, 134k lines, 20 agent-specific findings. Semgrep: 0 agent-specific. Bandit: 0 agent-specific.
Roadmap: Open-source CLI (now) → Argus Cloud ($30–200/dev/mo) → Argus Runtime (@argus.shield)
Tool Generic Issues Agent-Specific MCP Configs Trust Boundaries
Semgrep 45 0 ✗ ✗
Bandit 343 0 ✗ ✗
Argus (agent-audit) — 30+ ✓ ✓
// Projects

Selected work

Open Source
↗

agent-audit

CLI security scanner for AI agent codebases. 85+ rules, 7 engines. Python AST, taint tracking, MCP config auditing, semantic credential detection. Python / TypeScript / Go / Solidity. GitHub Action for CI/CD.

PythonASTTree-sitterSlitherCLI
Benchmark
↗

Agent-Vuln-Bench

First public benchmark for evaluating agent security tools. OWASP-aligned. No competitor has built one. Positions Argus as the standard-setter for agent security evaluation.

BenchmarkOWASPEvaluation
DeFi × Agent
↗

DeFi Shield Profile

Specialized security profile for DeFi agents (--profile defi). 20 additional rules for on-chain agent interactions. Cross-stack AI Agent × DeFi security audit — globally unique.

SolidityDeFiSlitherAgent Security
Research
↗

TrustAgent

Multi-Dimensional Trust Assessment Framework for LLM Agent Applications. Evaluating trust across safety, reliability, and compliance dimensions in production agent systems.

TrustLLM AgentsFramework
Research
↗

Robust Tool-Calling Benchmark

Robustness evaluation for tool-calling LLMs. Sim-to-Real gap perturbations on queries, tool descriptions, tool sets, and runtime environments. Testing if models reliably select and invoke tools under realistic variations.

LLM EvalTool CallingRobustnessSim2Real
Startup
↗

Topify.ai — GEO Agent

Built end-to-end Generative Engine Optimization agent as Founding Engineer. $1.5M seed, $300K bookings in 3 months. Origin story: where I first discovered agent security gaps at scale.

LangChainAgentGEOProduction
// Experience

Where I've built

Feb 2026 — Present

Co-founder & CEO

Argus

Building the security infrastructure for AI agents. Shipped 85+ rule CLI to PyPI. Filed vulnerabilities in 4 major frameworks (143k+ combined stars). First commercial audit completed. Agent-Vuln-Bench published. Two ACM demo papers submitted. Stanford SNAP Lab engagement.

Nov 2025 — Jan 2026

Founding Engineer

Topify.ai

Built end-to-end GEO agent from scratch. Company raised $1.5M seed, $300K bookings in 3 months. First-hand encounter with agent security gaps — exploitable tool definitions, wildcard MCP permissions, scattered credentials. Direct origin of Argus.

2025

Algorithm Engineer

PDD (Pinduoduo)

Causal inference and uplift modeling at one of the world's largest e-commerce platforms. Built models to measure and optimize treatment effects at scale.

2025 — 2027

M.S. in Electrical & Computer Engineering

University of Southern California (USC)

Research: LLM and agent security. USC FORTIS Lab under Prof. Yue Zhao (CMU PhD, 22k+ GitHub stars, 35M+ OSS downloads, NVIDIA & Amazon Research Awards).

2022 — 2025

B.S. in Electrical & Computer Engineering

Shanghai Jiao Tong University (SJTU)

Undergraduate degree in ECE from one of China's top engineering universities (C9 League).

// Research

Publications & Work in Progress

Agent-Audit: Detecting Agentic Vulnerabilities in AI Agent Code →
H. Zhang, et al. arXiv 2025
Two ACM Demo Papers — Static Analysis + Runtime Defense for AI Agents
USC FORTIS Lab. Under Review
Multilingual LLM Safety: Diagnosis and Solutions
Cross-lingual safety alignment. Target: NeurIPS 2026. In Preparation
Auditable Agents — Position Paper
Framework for building verifiable and auditable AI agent systems. In Preparation
TrustAgent: Multi-Dimensional Trust Assessment Framework for LLM Agent Applications
Systematic trust evaluation across safety, reliability, and compliance. In Preparation
Robust Tool-Calling Benchmark: Sim-to-Real Perturbation Evaluation
Robustness evaluation for tool-calling LLMs under realistic input variations. In Preparation
// Let's Connect

Building something with AI agents?
Let's talk security.

Open to security audits, design partnerships, research collaborations, and open-source contributions.

✉ haiyuez@usc.edu ◆ GitHub ● LinkedIn ◈ arXiv