The agentic era has a dirty little secret: while we celebrate the capability of multi-agent systems, we’re ignoring the attack surface they create. In 2026, enterprises aren’t running single AI assistants; they’re orchestrating swarms of support, sales, and ops agents wired into MCP servers, tool catalogs, and IAM roles. This interconnected mesh is a privilege escalation playground. An attacker doesn’t need to crack a password; they just need to find a path through the graph. SUNDER, a new project from developer Vishal Bharadwaj, tackles this by treating security remediation as a graph theory problem, specifically using minimum cuts to heal the mesh with minimal business impact.

The Graph Is the New Attack Surface

The source article describes a scenario where an attacker traverses six hops from an untrusted email to a prod-secrets-vault via support-agent, ticket-tool, jira-oauth, and vault-role. This chain of individually reasonable permissions is privilege escalation as graph traversal. Most security tools stop at finding these paths, but SUNDER’s bet was that an agent capable of reading the graph should also act on it optimally.

Minimum-Cut Remediation Over Naive Revocation

The naive fix is to revoke every inbound edge to the crown jewel, but that often breaks production. SUNDER computes the minimum s-t cut by wiring a virtual super-source to attacker entry points and a super-sink to the target. Crucially, every edge is assigned a cost representing business impact. For example, quarantining an untrusted data source is cheap (cost 1), while breaking an agent's ability to call a necessary tool is expensive (cost 5). The algorithm minimizes this cost, not just the edge count.

Optimizing for Business Impact

In the demo, the minimum-cost cut involved revoking three edges with a total cost of 3, specifically severing connections like public-webpage to research-agent and jira-oauth to vault-role. For comparison, a cut with the fewest edges also used 3 edges but resulted in a higher business impact cost of 6. SUNDER selected the option that removed the fewest working integrations while still sealing off the threat.

Built on FalkorDB and Max-Flow Algorithms

The system models the enterprise using six node labels including Agent, Tool, and Credential, connected by relationships like FEEDS and CAN_INVOKE. It leverages FalkorDB for graph operations, using openCypher for path enumeration and algorithms like pageRank and betweenness to identify choke points. Since the embedded build lacks native max-flow capabilities, SUNDER ships a dependency-free Dinic max-flow implementation to ensure the solution is verifiable on any deployment.

Guardrails for Autonomous Remediation

The agent exposes eleven tools via Python functions, an MCP server, and a FastAPI endpoint. It operates with strict guardrails: it must simulate the cut before applying it and verify the result afterward. The reasoning process shows steps like finding entry points, computing the minimum cut, and confirming zero attack paths remain. This ensures that a remediation agent does not just cut the graph arbitrarily but proves its fix worked.

Key Takeaways

  • SUNDER treats security remediation as a minimum s-t cut problem on the agent graph, optimizing for business impact cost rather than just edge count.
  • The system uses FalkorDB and a custom Dinic max-flow implementation to identify and sever the cheapest set of permissions that disconnects attacker entry points from crown jewels.
  • Autonomous remediation is guarded by a simulate-then-verify workflow, ensuring that every cut is proven to eliminate attack paths before being applied to the production mesh.

The Bottom Line

As agent meshes grow, static permission reviews are obsolete; we need graph-native immune systems that heal by the minimum cut.