First reported arxiv.org
Tools · latest
First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported knostic.ai
Building openclaw-shield: Lessons Learned Securing OpenClaw Agents
Knostic has open-sourced openclaw-shield, a security plugin for OpenClaw AI agents that enforces guardrails at the tool/execution layer rather than relying on prompts or transcript scanning. It uses a 5-layer defense-in-depth approach (prompt guard, output scanner, and an execution gate requiring explicit allow/deny decisions) to stop agents from leaking secrets, exposing PII, or running destructive commands like rm -rf. Details →First reported github.com
GitHub - cgrtml/reasongate: Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.
ReasonGate is an open-source explainable security gate for LLM applications that aims to block prompt injection while emitting an auditable reason for every allow/deny decision. Beyond text detection, it adds a capability-based 'agent action gate' (framed around the lethal-trifecta) that blocks tool calls by argument taint even when detection misses reworded attacks, with a live playground and a documented threat model describing its guarantees and non-guarantees. Details →First reported github.com
GitHub - AlwaysReadyAllies/warden: Drop-in security proxy for MCP — policy, tamper-evident audit, human approval, prompt-injection & secret-exfil defense. One line of config, zero code.
Warden is an open-source drop-in security proxy for the Model Context Protocol (MCP) that adds policy enforcement, tamper-evident audit logging, human approval gates, and defenses against prompt injection and secret exfiltration. The GitHub repository includes policies, examples, a SECURITY.md threat model, and a CI test matrix, and is configured via one line of config with no code changes. Details →First reported github.com
GitHub - gaur-avvv/wormxgpt: No limits. No filters. No restrictions. WormXGPT is a unified AI tooling suite containing both a premium Hacker-themed React Web Dashboard and an advanced Unfiltered CLI agent. It features 150+ tools, multi-server MCP integration, auto-fallback across 30+ providers, and local workspace integration.
WormXGPT is a GitHub-published "unfiltered" AI tooling suite (repo gaur-avvv/wormxgpt) marketed with the tagline "No limits. No filters. No restrictions," combining a hacker-themed web dashboard and a CLI agent with 150+ tools, multi-server MCP integration, and auto-fallback across 30+ AI providers. The project is presented as an unrestricted, jailbroken AI agent framework echoing WormGPT-style malicious LLM tooling. Details →First reported github.com
GitHub - ClickHouse/code-interpreter: Sandboxed code execution API for AI agents: powers LibreChat's Code Interpreter
ClickHouse's code-interpreter is an open-source sandboxed code execution API for AI agents, which powers LibreChat's Code Interpreter feature. The repository includes AppArmor profiles and CI hardening to isolate untrusted, agent-generated code execution. Details →First reported github.com
GitHub - pydantic/monty: A minimal, secure Python interpreter written in Rust for use by AI
Monty, from Pydantic, is a minimal, secure Python interpreter written in Rust intended for use by AI agents to execute generated code safely. It targets the emerging 'code mode' pattern where LLM agents write and run code to call MCP tools rather than invoking them directly, aiming to sandbox that execution. Details →First reported github.com
GitHub - clayseal/clayseal-identity: Runtime identity for AI agents. Short-lived attested credentials with capability tokens that agents narrow as tasks change and verify offline.
clayseal-identity is an open-source project providing runtime identity for AI agents, issuing short-lived attested credentials with capability tokens that agents can narrow as tasks change and verify offline. The repository includes backend, conformance tests, deployment configs, integrations, and examples for adding scoped, verifiable identity to agentic systems. Details →First reported giskard.ai
Prompt Injection | Giskard Documentation
Giskard's documentation describes the prompt-injection vulnerability category of its LLM red-teaming scanner, cataloguing runnable probes such as Best-of-N, DAN jailbreaks, math/Likert/citation/grandma framing, ASCII smuggling, encoding, transliteration, and the Deepset injection dataset used to test AI agents against OWASP LLM01. The probes reference underlying research including Best-of-N jailbreaking and Palo Alto Unit 42 multi-turn techniques. Details →First reported github.com
GitHub - rakshasa-1729/agentic-paved-roads: Generic security MCP server — brokers policies, risk, paved roads, and tools to coding agents. Talk demo for fwd:cloudsec 2026.
The agentic-paved-roads project is a generic security MCP (Model Context Protocol) server that brokers policies, risk assessments, paved roads, and tools to coding agents, published as a demo for a fwd:cloudsec 2026 talk. The repository ships runnable TypeScript code with tests, CI hardening, and release automation intended to enforce security controls on agent tool access. Details →First reported github.com
GitHub - beebeeVB/trajeckt: A causal firewall for AI agents: blocks multi-step tool-call chains that leak data, even when every call is individually allowed.
trajeckt is an open-source GitHub project described as a causal firewall for AI agents that blocks multi-step tool-call chains capable of leaking data even when each individual call is permitted. The repository includes SDKs, source, tests, benchmarks, and deployment configs. Details →First reported github.com
GitHub - Leporis14/agentlint: A proxy that sits between AI agents and the tools they use, deciding what's allowed, logging everything, and proving it to regulators
agentlint is an open-source proxy that sits between AI agents and the tools they call, enforcing what's allowed, logging all activity, and producing compliance evidence. Recent commits add scanning of CLI arguments for hardcoded secrets and a CI command/GitHub Action. Details →First reported github.com
GitHub - Lelu-ai/lelu: Open source authorization engine for AI agents. Confidence-aware gating · Human-in-the-loop review · Policy-as-code · Full audit trail
Lelu is an open-source authorization engine for AI agents offering confidence-aware gating, human-in-the-loop review, policy-as-code, and a full audit trail. It adds decision types (allow/deny/human_review/compute), payload hashing, and policy digests to control and audit agent tool actions. Details →First reported sauleau.com
Sven Sauleau: Systems Engineer - airgap - Security for the modern AI age
airgap is a Linux-only Rust tool (installable via `cargo install airgap`) that runs AI agents like claude/opencode and package managers like npm inside mount/user namespaces with a FUSE filesystem, redacting secrets in files (.env, SSH/PGP keys, .npmrc) and gating unexpected file access. It is positioned to prevent secret exfiltration by AI agents and malicious npm packages such as the Shai-Hulud worm. Details →First reported freyzo.github.io
deep-xpia - multi-hop cross-prompt injection benchmark
deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak. Details →First reported github.com
GitHub - denoland/clawpatrol: Security firewall for agents
Clawpatrol is an open-source security firewall for AI agents from denoland, designed to sandbox external plugins (treated as an untrusted supply-chain attack surface) using OS-level namespaces, Landlock, and macOS sandbox profiles, with permission lockfiles and brokered network dialing. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector