First reported · updated · 2 reports github.com
Tools · latest
First reported github.com
GitHub - snyk/agent-scan: Security scanner for AI agents, MCP servers and agent skills.
Snyk's agent-scan is an open-source security scanner (also distributed as the PyPI package snyk-agent-scan) that inspects AI agents, MCP servers, and agent skills for security issues. The GitHub repository shows active development, MCP-focused capabilities including a guard install for discovered servers, and references to MCP threats such as tool-poisoning and prompt injection. Details →First reported · updated · 2 reports github.com
GitHub - Jograph17/shieldprompt: Test your LLM app against adversarial prompt injection: static template scanning + a 13-payload attack battery. Zero dependencies.
shieldprompt is a zero-dependency tool for testing LLM applications against adversarial prompt injection, combining static template scanning with a 13-payload attack battery to probe an app's resistance to injection and jailbreak attempts. Details →First reported huggingface.co
patronus-studio/wolf-defender-prompt-injection
Wolf Defender is a multilingual ModernBERT-based (mmBERT-base) binary classifier published on Hugging Face by Patronus that detects prompt injections and jailbreak-style instructions before untrusted content reaches an LLM. The v2 release provides a 2,048-token context window, ONNX deployment variants, and benchmark results showing improved specificity on hard-benign inputs, and is intended as a local guardrail layer for AI agents, chatbots, and retrieval pipelines. Details →First reported github.com
GitHub - Ventrova/sentinel-scan-cli: Free CLI: OWASP LLM Top 10 mapped prompt-injection & jailbreak scanner for LLM apps, plus MCP config (mcp.json) security scanning.
Sentinel Scan CLI (by Ventrova) is a free command-line scanner and GitHub Action that tests LLM applications for prompt-injection and jailbreak weaknesses mapped to the OWASP LLM Top 10, and also performs security scanning of MCP configuration files (mcp.json). Details →First reported github.com
GitHub - NVIDIA/SkillSpector: Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
NVIDIA's SkillSpector is an open-source security scanner that inspects AI agent skills for vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before installation, supporting Claude Code, Codex, and MCP skills. The GitHub repository is publicly available with ongoing commits and releases. Details →First reported · updated · 2 reports medium.com
Don’t Let Your Agent Mess Up Your Database | by MCP Toolbox for Databases | Google Cloud - Community
MCP Toolbox for Databases (github.com/googleapis/genai-toolbox), a Google-published MCP server, introduces URL Parameter Binding, a feature that lets developers hardcode sensitive connection parameters into the URL so they remain outside the LLM's reach, mitigating confused-deputy attacks where an agent could be manipulated into unauthorized database actions. Details →First reported github.com
GitHub - occludra/gateway: Self-hosted AI security proxy. Redact PII, block prompt injection, route to any LLM provider. OpenAI-compatible.
occludra/gateway is a self-hosted, open-source AI security proxy that sits between applications and LLM providers to redact PII (via Microsoft Presidio), block prompt injection, and route requests to any OpenAI-compatible provider. The Apache-2.0 repository ships a proxy-api service, Presidio integration, configuration, and a Python SDK for deployment. Details →First reported github.com
customhouse/docs/false-positives.md at main · vineetpant/customhouse
customhouse is an MCP proxy that blocks prompt-injection exfiltration by tracking data provenance rather than inspecting content: once a session receives a result from an untrusted upstream MCP server, calls that move money or send data out are refused for the rest of the session. The write-up reports it blocked 11 of 11 injection scenarios but also flagged 4 of 10 benign workflows that used a sink, and analyzes each false positive. Details →First reported github.com
GitHub - fu351/Doberman-Core: Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute.
Doberman-Core is an open-source runtime guardrail for AI agents that sits between the model and its actions, gating every input, output, and tool call to block unsafe or unintended actions before they execute. The GitHub repository is actively developed with adapters including Codex hooks and CLI JSON-output contracts. Details →First reported · updated · 3 reports github.com
GitHub - sattyamjjain/agent-audit-kit: Static scanner for MCP-connected AI agent pipelines. 296 rules across 12 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
agent-audit-kit is a static scanner for MCP-connected AI agent pipelines, shipping 296 rules across 12 categories, mappings to 12 compliance frameworks, OWASP Agentic 10/10 and MCP 10/10 coverage, a GitHub Action, SARIF output, and a public CVE-to-rule ledger. The tool is aimed at helping defenders detect security weaknesses in AI agent and MCP integrations before deployment. Details →First reported github.com
Strip hidden unicode tags from python strings in order to avoid malicious prompt injection attacks
A GitHub gist titled "strip-unicode-tags.py" by user r-leyshon provides a Python script to strip hidden Unicode tag characters from strings in order to defend against malicious prompt injection attacks that abuse invisible/hidden Unicode characters. Details →First reported · updated · 2 reports howtoharden.com
Cursor Hardening Guide | How to Harden
The How to Harden Cursor guide provides a set of runnable hardening scripts (published in the grcengineering/how-to-harden GitHub repo) to secure the Cursor agentic coding IDE, covering privacy mode, .cursorignore templates, API key rotation, MCP server auditing, agent settings, rules-file auditing, workspace trust, extension auditing, telemetry, and network allowlisting. The guidance references known Cursor risks such as prompt injection, over-permissioned agent actions, and MCP-related CVEs (e.g., CVE-2025-54135/CurXecute and CVE-2025-54136/MCPoison). Details →First reported arxiv.org
CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs
CrackedPDFs is a controlled benchmark and dataset for hidden (indirect) prompt injection in PDFs, comprising 29,322 generated PDFs (9,774 injected, 19,548 benign/confounder) from 4,983 base documents, released with code and data on GitHub, Hugging Face, and Zenodo. The authors evaluate PromptGuard, a rule baseline, structural-only learned models, and a sanitized hybrid detector, reporting the hybrid detector reaching 0.960 F1 on a held-out set while noting it does not demonstrate broad real-world robustness. Details →First reported towardsdev.com
I Built a Prompt Injection Detector Using Go’s Standard Library
Cheikh seck describes building a prompt injection detector in Go using only the standard library — 29 regex rules and no ML models — tested against a product page seeded with 12 attack techniques drawn from a 2026 CrowdStrike prompt-injection taxonomy report. The accompanying code is published on GitHub (github.com/cheikh2shift/go-snippets/tree/main/prompt-injection). Details →First reported giskard.ai
Release Notes | Giskard Documentation
Giskard Hub UI release 2.5.0 adds a new TokenBreak security probe to its LLM red-teaming scanner, which tests whether an agent can be manipulated through obfuscated prompt injection by prepending characters to trigger words (e.g. 'ignore' → 'Aignore') to evade input classifiers while remaining interpretable to the LLM. The release also adds stateful multi-turn agent support and fine-grained probe selection for scans, and is based on HiddenLayer's TokenBreak attack research (arXiv:2506.07948). Details →First reported github.com
GitHub - butterclaw-tech/butterclaw: A local-first agentic SOC & security watchdog for autonomous AI agents. Dual‑hemisphere Gemma 4 reasoning, behavioral drift tracking, event ledger, and kinetic response via the ButterVault. Protects OpenClaw, Hermes-Agent, and other MCP-based agents from prompt injection and rogue behavior.
ButterClaw is a local-first agentic SOC and security watchdog for autonomous AI agents, using dual-hemisphere Gemma reasoning, behavioral drift tracking, an event ledger, and signature-based detection to protect MCP-based agents (such as OpenClaw and Hermes-Agent) from prompt injection and rogue behavior. Recent commits add sanitizer-aware detection signatures including a cloud metadata service probe and persistence-mechanism injection detector. Details →First reported github.com
GitHub - api7/aisix: Open-source AI gateway for LLMs & AI agents, built in Rust. One OpenAI-compatible API for OpenAI, Anthropic, Gemini, Bedrock & more — routing, guardrails, caching, rate limits, observability.
aisix (api7/aisix) is an open-source AI gateway written in Rust that provides a single OpenAI-compatible API across providers such as OpenAI, Anthropic, Gemini, and Bedrock, adding routing, guardrails, caching, rate limits, observability, and MCP policy controls. Commit history references MCP policy features (e.g. mcp_policies) intended to govern agent/tool access. Details →First reported github.com
GitHub - StackOneHQ/defender: Open source prompt injection protection for Agents calling tools (via MCP, CLI or direct function calling). Detect and defend against prompt injection attacks. 22MB, CPU-only, < 10ms latency.
Defender by StackOneHQ is an open-source tool that detects and defends against prompt injection attacks targeting AI agents that call tools via MCP, CLI, or direct function calling. It is described as a 22MB, CPU-only classifier with sub-10ms latency and covers both direct and indirect prompt injection. Details →First reported github.com
GitHub - dbreunig/drskill: Making sure your context is clean.
drskill is a GitHub tool by dbreunig for inspecting AI agent context and skill suites, listing configured MCP servers and their tools and generating injection review sheets to help ensure an agent's context is clean. The repo includes packaging, scripts, and MCP snapshot connection features. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported github.com
GitHub - joshfischer1108/jailbreak-lab: A hands-on kit for educational, authorized red teaming of any locally-run LLM.
jailbreak-lab (a.k.a. LLM Red Team Lab) by joshfischer1108 is a hands-on GitHub kit for educational, authorized red teaming of any locally-run, OpenAI-compatible LLM (Llama, Mistral, Qwen, Gemma, DeepSeek R1, etc.). It bundles real jailbreak techniques including instruction override, roleplay/DAN, hypothetical framing, encoding, and payload splitting. Details →First reported knostic.ai
Building openclaw-shield: Lessons Learned Securing OpenClaw Agents
Knostic has open-sourced openclaw-shield, a security plugin for OpenClaw AI agents that enforces guardrails at the tool/execution layer rather than relying on prompts or transcript scanning. It uses a 5-layer defense-in-depth approach (prompt guard, output scanner, and an execution gate requiring explicit allow/deny decisions) to stop agents from leaking secrets, exposing PII, or running destructive commands like rm -rf. Details →First reported github.com
GitHub - cgrtml/reasongate: Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.
ReasonGate is an open-source explainable security gate for LLM applications that aims to block prompt injection while emitting an auditable reason for every allow/deny decision. Beyond text detection, it adds a capability-based 'agent action gate' (framed around the lethal-trifecta) that blocks tool calls by argument taint even when detection misses reworded attacks, with a live playground and a documented threat model describing its guarantees and non-guarantees. Details →First reported github.com
GitHub - AlwaysReadyAllies/warden: Drop-in security proxy for MCP — policy, tamper-evident audit, human approval, prompt-injection & secret-exfil defense. One line of config, zero code.
Warden is an open-source drop-in security proxy for the Model Context Protocol (MCP) that adds policy enforcement, tamper-evident audit logging, human approval gates, and defenses against prompt injection and secret exfiltration. The GitHub repository includes policies, examples, a SECURITY.md threat model, and a CI test matrix, and is configured via one line of config with no code changes. Details →First reported github.com
GitHub - gaur-avvv/XGPT-WormGPT: [New Update](Added Agentic-Mode, Dark-GODMode)The Real BlackHat GPT - ai can do your illegal stuffs without saying anything. Use At Your Own Risk!
The GitHub repository XGPT-WormGPT (by user gaur-avvv) distributes a collection of jailbreak prompt files — including Agentic-Mode.txt, Dark-GODMode.txt, Dark.txt, and Gpt.txt — designed to bypass LLM safety guardrails and make AI models produce illicit content. Commit messages describe adding a 'fictional character WormGPT with malicious traits,' using the roleplay-persona framing as a technique to evade model refusals. Details →First reported giskard.ai
Prompt Injection | Giskard Documentation
Giskard's documentation describes the prompt-injection vulnerability category of its LLM red-teaming scanner, cataloguing runnable probes such as Best-of-N, DAN jailbreaks, math/Likert/citation/grandma framing, ASCII smuggling, encoding, transliteration, and the Deepset injection dataset used to test AI agents against OWASP LLM01. The probes reference underlying research including Best-of-N jailbreaking and Palo Alto Unit 42 multi-turn techniques. Details →First reported github.com
GitHub - bastion-soft/pi-detector-bench: Open, model-agnostic benchmark for prompt-injection detectors — scored on both axes (attack catch-rate and false positives on real traffic), threshold-agnostic, and reproducible from raw scores.
pi-detector-bench is an open, model-agnostic benchmark from bastion-soft for evaluating prompt-injection detectors, scoring both attack catch-rate and false positives on real traffic, with threshold-agnostic, reproducible results. It is published as a runnable GitHub repo with notebooks, scripts, and results. Details →First reported pypi.org
prompt-injection-defense
prompt-injection-defense is a Python package (pip install prompt-injection-defense) providing lightweight detection of prompt injection, jailbreaks, indirect injection, obfuscation, and unsafe content aligned to the OWASP LLM Top 10. It is an installable, MIT-licensed library maintained by Rajat Ghosh. Details →First reported github.com
GitHub - can995835646-byte/SentryGuard: Python CLI to detect Agentjacking injection attacks in Sentry error events
SentryGuard is a Python CLI that scans Sentry error events to detect 'Agentjacking' injection attacks — indirect prompt-injection payloads (e.g. system_prompt_injection, base64_shell_eval, 'ignore previous instructions', 'ADMIN OVERRIDE') that could trigger AI agents consuming error data. It also offers a sanitize command to strip system-prompt-style and prompt-override phrases from events. The repo is gated behind a Gumroad license check. Details →First reported ryandens.github.io
promptblock — block prompt injection in GitHub issues
promptblock is a GitHub tool that scans issue and comment bodies for prompt-injection payloads, specializing in instructions hidden inside HTML comments that GitHub's renderer drops but AI agents reading the raw API text still ingest. It splits bodies into visible and hidden segments, runs a bundled ML classifier, and flags risky content with a label and warning comment. Details →First reported github.com
GitHub - Jake-Schoellkopf/aicu: Black-box security scanner for LLM applications — prompt injection, safety bypass, credential leakage
aicu is an open-source black-box security scanner for LLM applications that tests for prompt injection, safety bypass, and credential leakage. It ships with 173 payloads across seven test suites and a full-scan CLI command. Details →First reported freyzo.github.io
deep-xpia - multi-hop cross-prompt injection benchmark
deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak. Details →First reported github.com
GitHub - denoland/clawpatrol: Security firewall for agents
Clawpatrol is an open-source security firewall for AI agents from denoland, designed to sandbox external plugins (treated as an untrusted supply-chain attack surface) using OS-level namespaces, Landlock, and macOS sandbox profiles, with permission lockfiles and brokered network dialing. Details →First reported github.com
GitHub - pixiebrix/agent-browser-shield: Browser extension with 35+ rules for keeping your AI agent safe while browsing
A GitHub repository for 'agent-browser-shield,' a browser extension by pixiebrix offering 35+ rules aimed at keeping AI agents safe while browsing. It is a defensive tool addressing risks to browser-based AI agents rather than a report of a specific threat. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector