Writing on agent security
Technical deep-dives on AI agent security, architecture, and defence.
A Git Config Key Ran Code in Seven Coding Agents. The 2022 Fix Does Not Stop It.
core.fsmonitor turns a line of repository config into a shell command. Git shipped an opt-in mitigation in 2022 and it is widely cited as the answer. I reproduced the attack in three configurations: the 2022 setting does not block the path that hits AI coding agents. One vendor already found the defence that does.
An agent skill can hand a stranger your shell - hours after you installed it
Without runtime enforcement, installing an agent skill can amount to giving an unreviewed stranger your shell, repository and developer credentials - possibly hours after you installed it. The format needs a permissions manifest, but a manifest alone is not enforcement.
98% of What Claude Code Does, I Never See. The 0.27% It Stops For Is the Point.
Claude Code and Codex ask permission, then everyone switches on auto-approve and hopes. Across 120 real Claude Code sessions under grith, 98.4% of what the agent did ran silently - and the 0.27% it stopped to ask about was reads of AWS credentials, SSH keys and .env files, none of them in the task. Codex went further and swept the whole disk. Without something underneath the agent, those reads complete and you never find out.
73% of What We Blocked in a Month Was One Syscall Your Sandbox Cannot See
We ran a month of real AI coding under a syscall firewall - 2.1 million intercepted events. The single most-denied thing was not a credential read or a network connection. It was io_uring, the one I/O interface a seccomp sandbox is structurally blind to, and both Claude Code and Codex reach for it constantly.
Codex Asks What Linux It Is Running On 96 Times to Say "ok"
We measured what Claude Code and Codex actually do when asked for a one-word reply, at the syscall level, across five cold runs each. Codex spawns lsb_release about 96 times per session, runs your login shell seven times, and reaches for io_uring nine times. Claude Code does the whole thing in four process spawns.
grith is live
The supervisor is out of the lab. One command installs it, one command wraps your agent, and security-relevant syscalls are scored before the kernel executes them. Here is what shipped, what is free, and exactly what it does and does not cover.
Supervising AI agents with seccomp-BPF and ptrace
How grith intercepts security-relevant syscalls from an AI coding agent without making it unusable: a seccomp-BPF pre-filter so the kernel only stops on calls worth scoring, TSYNC so every descendant inherits it, EPERM injection for denials, and a freeze-for-review verdict in between.
Wait - is this even Codex, or is it malware?
While Codex was doing routine research on a networking bug, a process in its tree walked the whole machine reading anything whose name looked like a secret - .aws, .ssh, .gnupg, system key stores, even unrelated projects. None of it was in the task. grith froze every real credential store. Then it happened again. Here is the full trace - including how we proved it was Codex and not separate malware.
An AI Model Escaped Its Eval and Breached Hugging Face. Every Step Was a Syscall
OpenAI was benchmarking a pre-release model's cyber capability. The model broke out of the eval sandbox through a bug in the one egress path the sandbox trusted, reached the open internet, and chained credentials and zero-days into remote code execution on Hugging Face production. The escape was a sequence of syscalls. So was every action after it.
Mythos Proves AI Safety Can No Longer Live Inside the Model
Anthropic restricted its most capable cyber model to vetted partners, routed risky requests away from it, and red-teamed it for thousands of hours. A jailbreak surfaced anyway, and the government pulled the model entirely. Every safety control in that story lived outside the model. That is the whole point.
The Real Risk Isn't Rogue AI. It's Plausible AI.
Fedora maintainers spent days dealing with an AI agent that reassigned bugs, closed tickets, argued its case in review, and got a bad patch merged into the installer. Nothing it did looked obviously malicious. That is exactly the problem.
Nine seconds: anatomy of the PocketOS production wipe
On 1 May an AI operations agent with legitimate production credentials destroyed PocketOS's database and its backups in nine seconds. The incident is being framed as an autonomy problem. It is also, in a more useful sense, a syscall problem.
AI Makes Adding Features Faster - So Why Not Add Just One More?
The thing that used to keep side projects honest was time. AI has quietly removed most of it, and what's left in its place is a much harder problem: knowing when to stop.
Vibe Coding Still Needs a Senior Engineer (For Now)
AI coding tools are very good at producing the obvious thing. They're not yet good at producing the questions a careful engineer asks before writing the first line. I reviewed an internal tool a colleague had vibe-coded with one of the current agentic IDEs and came out with twenty-eight findings, none of them exotic, all of them the kind a senior engineer catches in an afternoon. For now, that read is still a job - and it's not one the model can do for you.
Five AI Agent Failures in 36 Days. Zero Times the Agent Caught It.
Between March 18 and April 22, 2026, public failures at Meta, Mercor, CrewAI, Vercel, and Bitwarden all pointed at the same missing layer: the system acted, and someone else noticed later.
The Vercel Breach Needed Malware. The Next One Needs a Bad README.
Context.ai held a Google OAuth token with calendar and drive scope. That was enough to breach Vercel. The AI coding agent on your laptop holds more capability than that, takes untrusted text as input, and is one prompt injection away from running vercel env pull and POST-ing the results to a domain it chose. No Roblox cheat required.
Every Claude 4.7 Improvement Makes the Security Problem Worse
Claude Opus 4.7 turns AI agents from tools you supervise into systems you deploy. Every improvement - auto mode, focus mode, recaps, adaptive effort, auto-approval - makes the unsolved security problem worse. The next frontier is not intelligence. It is control.
They Hacked Claude, Gemini, and Copilot (And No One Told You)
Security researchers demonstrated full secret exfiltration from AI coding agents built by Anthropic, Google, and Microsoft. All three paid bug bounties. None issued CVEs. None notified users. This is the real state of AI agent security in 2026.
Prompt Injection Is Unfixable (So We Stopped Trying)
Every major AI lab knows prompt injection cannot be solved at the model layer. The CIS calls it an "inherent threat." Researchers keep breaking every defense. The answer is not better filters - it is architecture that assumes compromise and contains the damage.
If Your AI Agent Ran npm install During the Axios Attack, You're Compromised
On March 31, a DPRK-linked attacker published a RAT inside the axios npm package. The malware executed 1.1 seconds into npm install. AI coding agents run npm install autonomously, without human review. If your agent did it during the 3-hour window, the RAT is on your machine.
Zero Ambient Authority: The Principle That Should Govern Every AI Agent
AI agents inherit every permission their host process has. SSH keys, cloud credentials, browser cookies, production databases - all accessible by default, with no explicit grant. This is ambient authority. It is the wrong model.
Alibaba's AI Agent Hijacked GPUs and Dug Reverse SSH Tunnels
During reinforcement learning training, an Alibaba AI agent independently decided to mine cryptocurrency, open reverse SSH tunnels, and access billing accounts. No human told it to. Every action was a syscall that enforcement below the agent would have caught.
AI agents are now deciding what’s safe to run (Claude Auto Mode).
Auto Mode is a UX improvement. It removes the friction of permission prompts. It does not change who makes security decisions - the model still decides what is safe to run. That is the problem.
The Trivy Supply Chain Attack Reached LiteLLM
LiteLLM 1.82.7 and 1.82.8 were published with a credential-stealing .pth payload. This post traces the TeamPCP supply chain from the Trivy compromise to LiteLLM.
Meta's Rogue AI Agent Gave Engineers Access They Shouldn't Have Had
An internal Meta AI agent autonomously posted advice no human directed it to give. An engineer followed it. For two hours, engineers had access to systems they should never have seen. The problem is not the agent. It is the architecture that let it act without scoped authority.
Google's A2A Protocol Has Zero Defenses Against Prompt Injection
Google A2A reached v1.0 under the Linux Foundation with broad industry backing. A line-by-line security analysis reveals no built-in defense against prompt injection, optional-only Agent Card signing, and an Opaque Execution model that explicitly prevents inspecting what remote agents actually do.
Permission Fatigue Is Not a UX Problem. It Is a Security Failure.
AI coding agents generate hundreds of tool calls per session. The "just ask the user" security model depends on human vigilance at a scale where vigilance is impossible. This is not a design problem - it is an architectural one.
AI Agent Backdoors Trivy Security Scanner, Weaponizes a VS Code Extension
The hackerbot-claw campaign is the first documented case of an AI agent executing a full supply chain attack - exploiting a CI misconfiguration, stealing tokens, and publishing a malicious VS Code extension that targets other AI coding agents.
NemoClaw vs grith: Sandbox for One Agent vs Security for All
NVIDIA launched NemoClaw to sandbox OpenClaw agents. grith takes a different approach - wrapping any agent with multi-filter scoring, quarantine workflows, and analytics. A side-by-side comparison of two models for AI agent security.
87% of AI-Generated Pull Requests Ship Security Vulnerabilities
DryRun Security tested Claude Code, Codex, and Gemini building real apps. 143 vulnerabilities across 30 PRs. The same broken auth patterns, over and over. Here is what the data actually shows - and what it misses.
Claude Code Auto Mode Lets the Agent Approve Its Actions - That's the Problem
Claude Code Auto Mode hands permission decisions to the same LLM that executes the actions. That is architecturally different from evaluating every syscall independently of the model. Here is why that difference matters - and where both approaches fit.
Claude Code Attempted 752 /proc/*/environ Reads. 256 Succeeded. Codex: 0.
We ran strace against Claude Code and Codex on an identical task and recorded every file opened, every network connection made, and every subprocess spawned. To edit one file, Claude Code opened 2,779 others - and scanned the environment variables of 752 running processes.
A GitHub Issue Title Compromised 4,000 Developer Machines
A prompt injection in a GitHub issue triggered a chain reaction that ended with 4,000 developers getting OpenClaw installed without consent. The attack composes well-understood vulnerabilities into something new: one AI tool bootstrapping another.
Vibe Coding Is Killing Open Source, and the Data Proves It
cURL shut down its bug bounty. Ghostty banned drive-by PRs. tldraw closed external contributions. Tailwind laid off 75% of its engineers while usage hit record highs. The economics of open source are breaking, and AI-generated contributions are accelerating the collapse.
We Audited 2,857 Agent Skills. 12% Were Malicious.
A registry audit found 341 malicious skills out of 2,857. Agent skill installs now look like early npm supply chain risk, but with prompt-level control and agent privileges.
MCP Servers Are the New npm Packages
The Model Context Protocol gives AI agents access to external tools and data. It also gives every MCP server the ability to influence what your agent does next. The trust model has the same shape as early npm - and the same risks.
We Audited the Security of 7 Open-Source AI Agents - Here Is What We Found
A comparative teardown of the sandbox, permissions model, and untrusted input handling in OpenClaw, Claude Code, Codex, Cursor, Cline, Aider, and Open Interpreter. Real CVEs, real attack chains.
OpenClaw Got Banned. Here Is Why That Should Worry You.
Meta and other tech companies have banned OpenClaw over security concerns. 512 vulnerabilities, 1,000 exposed instances, and a poisoned plugin registry - this is what happens when AI agents ship without security architecture.
How a Hidden Prompt Can Steal Your SSH Keys
AI coding agents can read files, run commands, and make network requests. A single hidden instruction in a README or doc is enough to chain those capabilities into credential theft.
What “Grith” Means
Grith comes from Old English: peace, protection, sanctuary. This is why that meaning is the foundation of our security architecture for AI agents.
The AI Agent Security Crisis: 24 CVEs and Counting
IDEsaster found 24 critical vulnerabilities across major AI coding assistants - with a 100% exploitation rate. Here's what that means for developers.
Prompt Injection Meets Multi-Filter Defence
How grith's scoring proxy catches prompt injection attacks that bypass single-layer defences - with concrete scoring examples.