Skip to content

The Wire.AI Security News and Incident Tracker

Topic · 37 active items

Agentic AI Security Tools

Observed security tools, scanners, frameworks, and defensive or dual-use artifacts relevant to agentic AI systems.

Matching wire items

First reported today arxiv.org

Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming

Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets.

First reported 2d ago github.com

GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.

Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target.

First reported 3d ago github.com

GitHub - joshfischer1108/jailbreak-lab: A hands-on kit for educational, authorized red teaming of any locally-run LLM.

jailbreak-lab (a.k.a. LLM Red Team Lab) by joshfischer1108 is a hands-on GitHub kit for educational, authorized red teaming of any locally-run, OpenAI-compatible LLM (Llama, Mistral, Qwen, Gemma, DeepSeek R1, etc.). It bundles real jailbreak techniques including instruction override, roleplay/DAN, hypothetical framing, encoding, and payload splitting.

First reported 17 Jul knostic.ai

Building openclaw-shield: Lessons Learned Securing OpenClaw Agents

Knostic has open-sourced openclaw-shield, a security plugin for OpenClaw AI agents that enforces guardrails at the tool/execution layer rather than relying on prompts or transcript scanning. It uses a 5-layer defense-in-depth approach (prompt guard, output scanner, and an execution gate requiring explicit allow/deny decisions) to stop agents from leaking secrets, exposing PII, or running destructive commands like rm -rf.

First reported 16 Jul github.com

GitHub - cgrtml/reasongate: Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.

ReasonGate is an open-source explainable security gate for LLM applications that aims to block prompt injection while emitting an auditable reason for every allow/deny decision. Beyond text detection, it adds a capability-based 'agent action gate' (framed around the lethal-trifecta) that blocks tool calls by argument taint even when detection misses reworded attacks, with a live playground and a documented threat model describing its guarantees and non-guarantees.

First reported 16 Jul github.com

GitHub - AlwaysReadyAllies/warden: Drop-in security proxy for MCP — policy, tamper-evident audit, human approval, prompt-injection & secret-exfil defense. One line of config, zero code.

Warden is an open-source drop-in security proxy for the Model Context Protocol (MCP) that adds policy enforcement, tamper-evident audit logging, human approval gates, and defenses against prompt injection and secret exfiltration. The GitHub repository includes policies, examples, a SECURITY.md threat model, and a CI test matrix, and is configured via one line of config with no code changes.

First reported 16 Jul github.com

GitHub - geno2009/Evil-Gemini-v1: Evil Gemini v1 - Jailbreaked Gemini 2.5 Flash

A GitHub repository named 'Evil-Gemini-v1' by user geno2009 is published as a jailbreak of Google's Gemini 2.5 Flash model, framed as an 'Evil Gemini' variant that removes the model's safety restrictions. The available page content shows only GitHub navigation boilerplate, with no detailed technical mechanism, README, or evaluation exposed.

First reported 16 Jul github.com

GitHub - Kirozaku/Marina-GPT: M.A.R.I.N.A GPT a powerful, evil brother of WormGPT.

Marina-GPT (M.A.R.I.N.A GPT), hosted on GitHub by user Kirozaku, is a publicly available Python tool marketed as an 'evil brother of WormGPT,' an uncensored/malicious LLM assistant. The repo contains runnable scripts (marina.py, cheyy-linux.py, requirements.txt), a 'Marina Pro' variant, and a Bitcoin wallet address for payment.

First reported 16 Jul github.com

GitHub - jailbreakwormGPT/wormGPT: wormGPT free version

A GitHub repository under the account 'jailbreakwormGPT' publishes what it calls 'WormGPT 4,' described as an unrestricted large language model designed for automating text generation, distributed with a worm.py script and framed as a free version of the known malicious WormGPT tool.

First reported 16 Jul github.com

GitHub - gaur-avvv/XGPT-WormGPT: [New Update](Added Agentic-Mode, Dark-GODMode)The Real BlackHat GPT - ai can do your illegal stuffs without saying anything. Use At Your Own Risk!

The GitHub repository XGPT-WormGPT (by user gaur-avvv) distributes a collection of jailbreak prompt files — including Agentic-Mode.txt, Dark-GODMode.txt, Dark.txt, and Gpt.txt — designed to bypass LLM safety guardrails and make AI models produce illicit content. Commit messages describe adding a 'fictional character WormGPT with malicious traits,' using the roleplay-persona framing as a technique to evade model refusals.

First reported 16 Jul github.com

GitHub - gaur-avvv/wormxgpt: No limits. No filters. No restrictions. WormXGPT is a unified AI tooling suite containing both a premium Hacker-themed React Web Dashboard and an advanced Unfiltered CLI agent. It features 150+ tools, multi-server MCP integration, auto-fallback across 30+ providers, and local workspace integration.

WormXGPT is a GitHub-published "unfiltered" AI tooling suite (repo gaur-avvv/wormxgpt) marketed with the tagline "No limits. No filters. No restrictions," combining a hacker-themed web dashboard and a CLI agent with 150+ tools, multi-server MCP integration, and auto-fallback across 30+ AI providers. The project is presented as an unrestricted, jailbroken AI agent framework echoing WormGPT-style malicious LLM tooling.

First reported 15 Jul github.com

GitHub - davidmatousek/tachi: Threat modeling and AI-reasoning vulnerability detection harness for Claude Code — STRIDE + AI + MAESTRO

Tachi is an open-source GitHub project by davidmatousek providing a threat-modeling and AI-reasoning vulnerability detection harness for Claude Code, combining STRIDE, AI-specific, and MAESTRO threat frameworks. The repo references OWASP Top 10 for LLM and Agentic Applications and is actively developed with numerous releases.

First reported 14 Jul github.com

GitHub - ClickHouse/code-interpreter: Sandboxed code execution API for AI agents: powers LibreChat's Code Interpreter

ClickHouse's code-interpreter is an open-source sandboxed code execution API for AI agents, which powers LibreChat's Code Interpreter feature. The repository includes AppArmor profiles and CI hardening to isolate untrusted, agent-generated code execution.

First reported 14 Jul github.com

GitHub - pydantic/monty: A minimal, secure Python interpreter written in Rust for use by AI

Monty, from Pydantic, is a minimal, secure Python interpreter written in Rust intended for use by AI agents to execute generated code safely. It targets the emerging 'code mode' pattern where LLM agents write and run code to call MCP tools rather than invoking them directly, aiming to sandbox that execution.

First reported 13 Jul github.com

GitHub - clayseal/clayseal-identity: Runtime identity for AI agents. Short-lived attested credentials with capability tokens that agents narrow as tasks change and verify offline.

clayseal-identity is an open-source project providing runtime identity for AI agents, issuing short-lived attested credentials with capability tokens that agents can narrow as tasks change and verify offline. The repository includes backend, conformance tests, deployment configs, integrations, and examples for adding scoped, verifiable identity to agentic systems.

First reported 13 Jul github.com

GitHub - JustiNoel/LLM-Prompt-Injection: A .py code that acts as a middleware between the user and the LLM before producing the output

The GitHub repository JustiNoel/LLM-Prompt-Injection publishes 'prompt-shield', a Python middleware that sits between the user and an LLM to inspect input before output is produced, packaged with Docker Compose for deployment. The provided page shows only the repository file structure and no detailed technical mechanism or evaluation.

First reported 13 Jul github.com

LLM-Security-Jailbreak/docs/INTEGRITY_LEDGER.md at main · wherewolf87/LLM-Security-Jailbreak

The LLM-Security-Jailbreak repository, a fork of elder-plinius/T3MP3ST, publishes an 'Integrity Ledger' documenting a hardened jailbreak/security-testing harness run against the 104-challenge XBEN black-box benchmark across models including GLM-5.2 and gpt-5.5, with self-audited results tracking contamination and methodology corrections.

First reported 13 Jul giskard.ai

Prompt Injection | Giskard Documentation

Giskard's documentation describes the prompt-injection vulnerability category of its LLM red-teaming scanner, cataloguing runnable probes such as Best-of-N, DAN jailbreaks, math/Likert/citation/grandma framing, ASCII smuggling, encoding, transliteration, and the Deepset injection dataset used to test AI agents against OWASP LLM01. The probes reference underlying research including Best-of-N jailbreaking and Palo Alto Unit 42 multi-turn techniques.

First reported 8 Jul github.com

GitHub - rakshasa-1729/agentic-paved-roads: Generic security MCP server — brokers policies, risk, paved roads, and tools to coding agents. Talk demo for fwd:cloudsec 2026.

The agentic-paved-roads project is a generic security MCP (Model Context Protocol) server that brokers policies, risk assessments, paved roads, and tools to coding agents, published as a demo for a fwd:cloudsec 2026 talk. The repository ships runnable TypeScript code with tests, CI hardening, and release automation intended to enforce security controls on agent tool access.

First reported 6 Jul github.com

GitHub - xalgord/xalgorix: Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

Xalgorix is an open-source GitHub project (Go + TypeScript) presenting autonomous AI pentesting agents that perform real-time reconnaissance, vulnerability detection, and exploitation orchestration. The repository is actively developed with hundreds of commits and tagged releases.

First reported 4 Jul github.com

GitHub - manojmallick/gavio: The open standard AI gateway — PII protection, audit, reliability & cost control as composable interceptors. Same API in Python, Java & JavaScript.

Gavio is an open-source AI gateway that adds PII protection, audit logging, reliability and cost control as composable interceptors, with a consistent API across Python, Java and JavaScript. It sits in front of LLM providers to inspect and mediate requests/responses.

First reported 29 Jun github.com

GitHub - beebeeVB/trajeckt: A causal firewall for AI agents: blocks multi-step tool-call chains that leak data, even when every call is individually allowed.

trajeckt is an open-source GitHub project described as a causal firewall for AI agents that blocks multi-step tool-call chains capable of leaking data even when each individual call is permitted. The repository includes SDKs, source, tests, benchmarks, and deployment configs.

First reported 29 Jun github.com

GitHub - vinerya/driftGuard: Embedding-based response drift detection for LangChain agents.

driftGuard is a Python package providing embedding-based response drift detection for LangChain agents, intended to monitor and detect when agent responses deviate over time.

First reported 29 Jun github.com

GitHub - bastion-soft/pi-detector-bench: Open, model-agnostic benchmark for prompt-injection detectors — scored on both axes (attack catch-rate and false positives on real traffic), threshold-agnostic, and reproducible from raw scores.

pi-detector-bench is an open, model-agnostic benchmark from bastion-soft for evaluating prompt-injection detectors, scoring both attack catch-rate and false positives on real traffic, with threshold-agnostic, reproducible results. It is published as a runnable GitHub repo with notebooks, scripts, and results.

First reported 29 Jun pypi.org

prompt-injection-defense

prompt-injection-defense is a Python package (pip install prompt-injection-defense) providing lightweight detection of prompt injection, jailbreaks, indirect injection, obfuscation, and unsafe content aligned to the OWASP LLM Top 10. It is an installable, MIT-licensed library maintained by Rajat Ghosh.

First reported 26 Jun github.com

GitHub - Leporis14/agentlint: A proxy that sits between AI agents and the tools they use, deciding what's allowed, logging everything, and proving it to regulators

agentlint is an open-source proxy that sits between AI agents and the tools they call, enforcing what's allowed, logging all activity, and producing compliance evidence. Recent commits add scanning of CLI arguments for hardcoded secrets and a CI command/GitHub Action.

First reported 24 Jun github.com

GitHub - Lelu-ai/lelu: Open source authorization engine for AI agents. Confidence-aware gating · Human-in-the-loop review · Policy-as-code · Full audit trail

Lelu is an open-source authorization engine for AI agents offering confidence-aware gating, human-in-the-loop review, policy-as-code, and a full audit trail. It adds decision types (allow/deny/human_review/compute), payload hashing, and policy digests to control and audit agent tool actions.

First reported 24 Jun github.com

GitHub - can995835646-byte/SentryGuard: Python CLI to detect Agentjacking injection attacks in Sentry error events

SentryGuard is a Python CLI that scans Sentry error events to detect 'Agentjacking' injection attacks — indirect prompt-injection payloads (e.g. system_prompt_injection, base64_shell_eval, 'ignore previous instructions', 'ADMIN OVERRIDE') that could trigger AI agents consuming error data. It also offers a sanitize command to strip system-prompt-style and prompt-override phrases from events. The repo is gated behind a Gumroad license check.

First reported 22 Jun knostic.ai

OpenAnt: Read the LLM Vulnerability Paper

Knostic announced OpenAnt, described as an open source LLM vulnerability discovery project, now published on arXiv. The article provides minimal detail beyond the project's existence and its framing as a leading open source effort for finding LLM vulnerabilities.

First reported 22 Jun ryandens.github.io

promptblock — block prompt injection in GitHub issues

promptblock is a GitHub tool that scans issue and comment bodies for prompt-injection payloads, specializing in instructions hidden inside HTML comments that GitHub's renderer drops but AI agents reading the raw API text still ingest. It splits bodies into visible and hidden segments, runs a bundled ML classifier, and flags risky content with a label and warning comment.

First reported 21 Jun jackdavis.net

Maintaining Privacy With Agents: What Actually Works When Sensitive Data Is Part of the Workflow

A write-up releasing `agent-privacy`, an open-source privacy-control layer for CLI-style agent harnesses that intercept sensitive data (PII, identifiers) before it becomes model-visible context. It uses prompt/pre-tool/post-tool hooks with four actions — allow, redact, handoff, block — and integrates a local filter service, OpenAI Privacy Filter, and local Qwen models, with an operational pii-guard report covering ~6,343 screening decisions.

First reported 20 Jun github.com

GitHub - rewired89/HSIP-1PHASE: A self-hosted identity server that gives AI agents a cryptographic identity, generates tamper-proof audit trails, and covers financial compliance requirements (MiFID II, FINRA 4511, SOX §404, DORA, SWIFT CSCF) all in a single Rust binary with no cloud dependency.

HSIP-1PHASE is a self-hosted Rust binary identity server that assigns AI agents a cryptographic identity, produces tamper-proof audit trails of agent actions, and maps to financial compliance regimes (MiFID II, FINRA 4511, SOX §404, DORA, SWIFT CSCF). It ships with a browser extension that surfaces an AI agent activity panel and recent audit entries.

First reported 19 Jun sauleau.com

Sven Sauleau: Systems Engineer - airgap - Security for the modern AI age

airgap is a Linux-only Rust tool (installable via `cargo install airgap`) that runs AI agents like claude/opencode and package managers like npm inside mount/user namespaces with a FUSE filesystem, redacting secrets in files (.env, SSH/PGP keys, .npmrc) and gating unexpected file access. It is positioned to prevent secret exfiltration by AI agents and malicious npm packages such as the Shai-Hulud worm.

First reported 18 Jun github.com

GitHub - Jake-Schoellkopf/aicu: Black-box security scanner for LLM applications — prompt injection, safety bypass, credential leakage

aicu is an open-source black-box security scanner for LLM applications that tests for prompt injection, safety bypass, and credential leakage. It ships with 173 payloads across seven test suites and a full-scan CLI command.

First reported 16 Jun freyzo.github.io

deep-xpia - multi-hop cross-prompt injection benchmark

deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak.

First reported 9 Jun github.com

GitHub - denoland/clawpatrol: Security firewall for agents

Clawpatrol is an open-source security firewall for AI agents from denoland, designed to sandbox external plugins (treated as an untrusted supply-chain attack surface) using OS-level namespaces, Landlock, and macOS sandbox profiles, with permission lockfiles and brokered network dialing.

First reported 3 Jun github.com

GitHub - pixiebrix/agent-browser-shield: Browser extension with 35+ rules for keeping your AI agent safe while browsing

A GitHub repository for 'agent-browser-shield,' a browser extension by pixiebrix offering 35+ rules aimed at keeping AI agents safe while browsing. It is a defensive tool addressing risks to browser-based AI agents rather than a report of a specific threat.