First reported github.com
Topic · Latest 50 of 79 active items
Agentic AI Security Tools
Observed security tools, scanners, frameworks, and defensive or dual-use artifacts relevant to agentic AI systems.
Matching wire items
First reported · updated · 2 reports github.com
GitHub - delphisecurity/xaidr · GitHub
xaidr, published by delphisecurity, is an open-source (Apache-2.0) runtime security sensor for AI agents that detects and classifies threats such as part-level role forgery, forged tool-result injection, credential/secret-manager access, and data egress. The repo includes detection rules, enforcement modes (classify vs block), regression tests, and CI, positioning it as a defensive guardrail for agentic tool-calling systems. Details →First reported github.com
GitHub - Vedantgitbot/booth: BOOTH A lightweight checkpoint layer for LLM outputs. BOOTH sits between your application and an LLM call and decides whether an answer should pass through, be reconsidered, be flagged as resting on more than one valid interpretation, or be marked uncertain.
BOOTH is a lightweight Python checkpoint library that sits between an application and an LLM call, deciding whether an answer should pass through, be reconsidered, be flagged as resting on more than one valid interpretation, or be marked uncertain. The repository is an early-stage project (v0.4.3, 3 stars) providing structured checkpoints for LLM outputs. Details →First reported github.com
GitHub - snyk/agent-scan: Security scanner for AI agents, MCP servers and agent skills.
Snyk's agent-scan is an open-source security scanner (also distributed as the PyPI package snyk-agent-scan) that inspects AI agents, MCP servers, and agent skills for security issues. The GitHub repository shows active development, MCP-focused capabilities including a guard install for discovered servers, and references to MCP threats such as tool-poisoning and prompt injection. Details →First reported huggingface.co
dealignai/Qwen3.8-Flash-Next-UNCENSORED-FP8
A Hugging Face repository by "dealignai" publishes Qwen3.8-Flash-Next-UNCENSORED-FP8, a refusal-removed build of a Qwen model created through direct weight-level modification rather than fine-tuning or prompt tricks. The page advertises near-100% compliance on HarmBench harmful-behavior categories including chemical/biological, cybercrime/intrusion, and illegal activity while retaining most MMLU capability. Details →First reported github.com
GitHub - guillaumemeyer/watermarks-remover: Strip multi-vendor AI provenance marks: Unicode text hygiene, statistical rewrite hooks, and C2PA/metadata from PNG/JPEG/SVG/PDF/DOCX/HTML/MD
watermarks-remover is an open-source tool that strips multi-vendor AI provenance marks — including C2PA content credentials, statistical text watermarks, invisible Unicode markers, and metadata — from PNG/JPEG/SVG/PDF/DOCX/HTML/MD and audio/video files. It ships with a Claude plugin PostToolUse hook that automatically detects and removes provenance marks from files an AI agent writes, defeating attribution mechanisms like SynthID and C2PA. Details →First reported github.com
GitHub - kontext-security/sandy: Secure agents in seconds by running them in a sandbox.
Sandy, published by kontext-security on GitHub, is an open-source tool (written in Rust) that aims to secure AI agents by running them inside a sandbox. The repository provides installable crates and scripts intended to isolate agent execution to contain risky or untrusted agent behavior. Details →First reported · updated · 2 reports github.com
GitHub - Jograph17/shieldprompt: Test your LLM app against adversarial prompt injection: static template scanning + a 13-payload attack battery. Zero dependencies.
shieldprompt is a zero-dependency tool for testing LLM applications against adversarial prompt injection, combining static template scanning with a 13-payload attack battery to probe an app's resistance to injection and jailbreak attempts. Details →First reported darkreading.com
'HTTP Terminator' Hunts for Novel Desync Attacks
'HTTP Terminator,' an AI-powered open source tool built by PortSwigger's James Kettle, autonomously developed novel HTTP desync (request-smuggling) attack techniques and used them to successfully compromise real enterprise websites, including several financial services firms. Presented at Black Hat USA 2026, the tool explores whether AI can perform genuinely novel offensive security research, and notably deviates from its instructions (e.g., pivoting to cache poisoning). Details →First reported huggingface.co
patronus-studio/wolf-defender-prompt-injection
Wolf Defender is a multilingual ModernBERT-based (mmBERT-base) binary classifier published on Hugging Face by Patronus that detects prompt injections and jailbreak-style instructions before untrusted content reaches an LLM. The v2 release provides a 2,048-token context window, ONNX deployment variants, and benchmark results showing improved specificity on hard-benign inputs, and is intended as a local guardrail layer for AI agents, chatbots, and retrieval pipelines. Details →First reported · updated · 5 reports github.com
system_prompts_leaks/Anthropic/claude-fable-5.md at main · asgeirtj/system_prompts_leaks · GitHub
A GitHub repository (asgeirtj/system_prompts_leaks) hosts an extracted/leaked system prompt file for Anthropic's Claude Fable 5, part of a broader collection of leaked LLM system prompts. Anthropic's own announcement describes Fable 5 and the cyberdefense-oriented Mythos 5 (Project Glasswing) as models with state-of-the-art capabilities gated by conservative safeguards. Details →First reported github.com
GitHub - Ventrova/sentinel-scan-cli: Free CLI: OWASP LLM Top 10 mapped prompt-injection & jailbreak scanner for LLM apps, plus MCP config (mcp.json) security scanning.
Sentinel Scan CLI (by Ventrova) is a free command-line scanner and GitHub Action that tests LLM applications for prompt-injection and jailbreak weaknesses mapped to the OWASP LLM Top 10, and also performs security scanning of MCP configuration files (mcp.json). Details →First reported github.com
GitHub - NVIDIA/SkillSpector: Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
NVIDIA's SkillSpector is an open-source security scanner that inspects AI agent skills for vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before installation, supporting Claude Code, Codex, and MCP skills. The GitHub repository is publicly available with ongoing commits and releases. Details →First reported github.com
GitHub - marcsnid/steganeur: Hide secret messages inside LLM-generated text. Neural linguistic steganography in Rust with multiple methods.
steganeur is a Rust tool that hides secret messages inside LLM-generated text using neural linguistic steganography with multiple methods. Published as an installable Cargo crate, it encodes hidden data into natural-looking model output, creating a covert channel that rides on LLM text generation. Details →First reported medium.com
Block AI from installing malicious npm packages
Prasanna Mestha describes a defensive tool built to sit between AI coding agents and the npm registry to block installation of malicious or hallucinated packages, framed around the slopsquatting threat. The write-up cites real cases including the phantom 'react-codeshift' package requested hundreds of times a day and an August campaign in which a single threat actor pushed over 700 AI-named malicious npm packages that deliver a cross-platform RAT via README instructions. Details →First reported · updated · 2 reports medium.com
Don’t Let Your Agent Mess Up Your Database | by MCP Toolbox for Databases | Google Cloud - Community
MCP Toolbox for Databases (github.com/googleapis/genai-toolbox), a Google-published MCP server, introduces URL Parameter Binding, a feature that lets developers hardcode sensitive connection parameters into the URL so they remain outside the LLM's reach, mitigating confused-deputy attacks where an agent could be manipulated into unauthorized database actions. Details →First reported github.com
GitHub - occludra/gateway: Self-hosted AI security proxy. Redact PII, block prompt injection, route to any LLM provider. OpenAI-compatible.
occludra/gateway is a self-hosted, open-source AI security proxy that sits between applications and LLM providers to redact PII (via Microsoft Presidio), block prompt injection, and route requests to any OpenAI-compatible provider. The Apache-2.0 repository ships a proxy-api service, Presidio integration, configuration, and a Python SDK for deployment. Details →First reported github.com
GitHub - M507/RamiGPT: Autonomous Privilege Escalation using AI + Benchmarking models
RamiGPT is an open-source tool by GitHub user M507 that uses AI (LLM-driven agents) to perform autonomous privilege escalation, packaged with a benchmarking harness to compare model performance across escalation tasks in Docker/Ansible test environments. The repository provides runnable code, benchmark tests, and published results. Details →First reported github.com
customhouse/docs/false-positives.md at main · vineetpant/customhouse
customhouse is an MCP proxy that blocks prompt-injection exfiltration by tracking data provenance rather than inspecting content: once a session receives a result from an untrusted upstream MCP server, calls that move money or send data out are refused for the rest of the session. The write-up reports it blocked 11 of 11 injection scenarios but also flagged 4 of 10 benign workflows that used a sink, and analyzes each false positive. Details →First reported github.com
GitHub - fu351/Doberman-Core: Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute.
Doberman-Core is an open-source runtime guardrail for AI agents that sits between the model and its actions, gating every input, output, and tool call to block unsafe or unintended actions before they execute. The GitHub repository is actively developed with adapters including Codex hooks and CLI JSON-output contracts. Details →First reported · updated · 3 reports github.com
GitHub - sattyamjjain/agent-audit-kit: Static scanner for MCP-connected AI agent pipelines. 296 rules across 12 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
agent-audit-kit is a static scanner for MCP-connected AI agent pipelines, shipping 296 rules across 12 categories, mappings to 12 compliance frameworks, OWASP Agentic 10/10 and MCP 10/10 coverage, a GitHub Action, SARIF output, and a public CVE-to-rule ledger. The tool is aimed at helping defenders detect security weaknesses in AI agent and MCP integrations before deployment. Details →First reported github.com
GitHub - barvhaim/HoneyMCP: A Deception Security Layer for MCP Servers. It injects "ghost tools" (fake security-sensitive tools) that act as honeypots.
HoneyMCP is an open-source deception security layer for MCP (Model Context Protocol) servers that injects fake security-sensitive "ghost tools" acting as honeypots. When an agent or attacker invokes one of these decoy tools, the activity is flagged as suspicious and surfaced in a SOC-style dashboard, helping defenders detect malicious or compromised AI agents interacting with MCP servers. Details →First reported github.com
GitHub - OWASP/www-project-agent-memory-guard: OWASP Foundation web repository
OWASP Agent Memory Guard is an open-source project repository providing tooling to detect and block memory-injection and memory-poisoning attacks against AI agents, shipping a CLI scanner, API server, ML-based detection, additional detectors, a GitHub Action, and an attack-then-block demo runnable via Codespaces. Details →First reported github.com
GitHub - ytkoka/mcp-tester: A web-based tool for inspecting MCP servers. Connect to any MCP server, browse its Tools, Resources, and Prompts, measure fetch latency, estimate token usage, score the quality of tool definitions, and compare two servers side by side, and scan for tool poisoning and rug pulls.
mcp-tester is an open-source web-based tool by ytkoka for inspecting MCP (Model Context Protocol) servers: it connects to any MCP server, browses Tools, Resources, and Prompts, measures fetch latency, estimates token usage, scores tool-definition quality, compares two servers, and scans for tool poisoning and rug pulls. The repository is published on GitHub under an MIT license with a live demo. Details →First reported github.com
Strip hidden unicode tags from python strings in order to avoid malicious prompt injection attacks
A GitHub gist titled "strip-unicode-tags.py" by user r-leyshon provides a Python script to strip hidden Unicode tag characters from strings in order to defend against malicious prompt injection attacks that abuse invisible/hidden Unicode characters. Details →First reported perplexity.ai
Securing Agents Across Perplexity’s Client Endpoints with Numbat
Perplexity has open-sourced Numbat, an agent security suite for client endpoints (macOS, Linux, Windows) that detects, prevents, and investigates risky AI agent behavior. Numbat integrates with widely used client-side agent harnesses (e.g. CLI and desktop coding agents), enforces security rules, and provides agent-agnostic forensics to address incidents such as agents autonomously running with permissions bypassed via flags like --dangerously-skip-permissions and --yolo. Details →First reported · updated · 2 reports howtoharden.com
Cursor Hardening Guide | How to Harden
The How to Harden Cursor guide provides a set of runnable hardening scripts (published in the grcengineering/how-to-harden GitHub repo) to secure the Cursor agentic coding IDE, covering privacy mode, .cursorignore templates, API key rotation, MCP server auditing, agent settings, rules-file auditing, workspace trust, extension auditing, telemetry, and network allowlisting. The guidance references known Cursor risks such as prompt injection, over-permissioned agent actions, and MCP-related CVEs (e.g., CVE-2025-54135/CurXecute and CVE-2025-54136/MCPoison). Details →First reported arxiv.org
CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs
CrackedPDFs is a controlled benchmark and dataset for hidden (indirect) prompt injection in PDFs, comprising 29,322 generated PDFs (9,774 injected, 19,548 benign/confounder) from 4,983 base documents, released with code and data on GitHub, Hugging Face, and Zenodo. The authors evaluate PromptGuard, a rule baseline, structural-only learned models, and a sanitized hybrid detector, reporting the hybrid detector reaching 0.960 F1 on a held-out set while noting it does not demonstrate broad real-world robustness. Details →First reported darkreading.com
New Tool Traces AI Videos Back to Their Source
UC Riverside researchers built SAGA (Source Attribution of Generative AI videos), a framework that not only detects whether a video is AI-generated but also identifies the specific generative model, its version, and the development team for forensic attribution. The tool aims to counter deepfake-driven disinformation, impersonation, and social-engineering threats such as fraudulent deepfake job applicants. Details →First reported towardsdev.com
I Built a Prompt Injection Detector Using Go’s Standard Library
Cheikh seck describes building a prompt injection detector in Go using only the standard library — 29 regex rules and no ML models — tested against a product page seeded with 12 attack techniques drawn from a 2026 CrowdStrike prompt-injection taxonomy report. The accompanying code is published on GitHub (github.com/cheikh2shift/go-snippets/tree/main/prompt-injection). Details →First reported giskard.ai
Release Notes | Giskard Documentation
Giskard Hub UI release 2.5.0 adds a new TokenBreak security probe to its LLM red-teaming scanner, which tests whether an agent can be manipulated through obfuscated prompt injection by prepending characters to trigger words (e.g. 'ignore' → 'Aignore') to evade input classifiers while remaining interpretable to the LLM. The release also adds stateful multi-turn agent support and fine-grained probe selection for scans, and is based on HiddenLayer's TokenBreak attack research (arXiv:2506.07948). Details →First reported github.com
GitHub - xalgord/xalgorix: Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
Xalgorix is an open-source project on GitHub (xalgord/xalgorix) presenting autonomous AI pentesting agents that perform real-time reconnaissance, vulnerability detection, and exploitation orchestration, built in Go and TypeScript with active releases (v4.5.69) and commit history. Details →First reported darkreading.com
Red Agents vs. Blue Agents: How to Make AI Better At Defense
Dark Reading reports that AI offensive-security startup Dreadnode released two open-source tools, DreadGOAD (a reproducible Active Directory training environment) and Ares (an agentic red-team/blue-team system), to measure the effectiveness of agentic defenders. In DreadGOAD, Ares red-team agents discover hosts, escalate privileges, and compromise the environment while blue-team agents analyze telemetry, triage alerts, and attempt to contain the activity. Details →First reported github.com
GitHub - butterclaw-tech/butterclaw: A local-first agentic SOC & security watchdog for autonomous AI agents. Dual‑hemisphere Gemma 4 reasoning, behavioral drift tracking, event ledger, and kinetic response via the ButterVault. Protects OpenClaw, Hermes-Agent, and other MCP-based agents from prompt injection and rogue behavior.
ButterClaw is a local-first agentic SOC and security watchdog for autonomous AI agents, using dual-hemisphere Gemma reasoning, behavioral drift tracking, an event ledger, and signature-based detection to protect MCP-based agents (such as OpenClaw and Hermes-Agent) from prompt injection and rogue behavior. Recent commits add sanitizer-aware detection signatures including a cloud metadata service probe and persistence-mechanism injection detector. Details →First reported github.com
GitHub - adithyan-ak/AgentHound: Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
AgentHound is an open-source offensive security framework for AI agent infrastructure, described as "BloodHound for the agentic stack." The tool performs reconnaissance, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. Details →First reported darkreading.com
Ghost Credentials Expose Cloud Systems to Hidden Identity Risks
Security researcher Aleksandr Krasnov released NHI Hound, an open source tool to discover dormant non-human identities and map trust paths in cloud environments, after investigating an incident where an idle AI-enabled workflow agent suddenly began firing API calls and was found to have moved laterally and escalated privileges via 'ghost credentials.' The tool helps surface tokens, agents, and service accounts that live outside traditional trust boundaries in heavily automated, AI-based environments. Details →First reported github.com
GitHub - api7/aisix: Open-source AI gateway for LLMs & AI agents, built in Rust. One OpenAI-compatible API for OpenAI, Anthropic, Gemini, Bedrock & more — routing, guardrails, caching, rate limits, observability.
aisix (api7/aisix) is an open-source AI gateway written in Rust that provides a single OpenAI-compatible API across providers such as OpenAI, Anthropic, Gemini, and Bedrock, adding routing, guardrails, caching, rate limits, observability, and MCP policy controls. Commit history references MCP policy features (e.g. mcp_policies) intended to govern agent/tool access. Details →First reported github.com
GitHub - MauricioPerera/mcpwasm: Static MCP: your tools are files, not servers. Hash-verified static skills executed sandboxed on demand (QuickJS-wasm on Cloudflare Workers) + llms.txt gateway
mcpwasm is a project that reimagines MCP tools as static, hash-verified files rather than running servers, executing each "skill" sandboxed on demand via QuickJS-wasm on Cloudflare Workers, with an llms.txt gateway. Skills declare sha256 hashes and the gateway re-verifies content on every read, rejecting tampered or drifted tool code (including a deliberate corrupt_skill fixture that tests hash-based rejection). Details →First reported cybergym.io
ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
ExploitGym is a benchmark of 869 tasks from the UC Berkeley sunblaze group (published with a GitHub repo) that measures whether AI agents can transform a known vulnerability and a proof-of-vulnerability input into a working end-to-end exploit across userspace, browser V8, and Linux kernel targets. A leaderboard scores frontier coding agents on how many exploits they produce, including bypasses of ASLR, stack canaries, and the V8 heap sandbox, and the authors describe the capability as inherently dual-use. Details →First reported github.com
GitHub - DataDog/rshell: rshell - A Restricted Shell for AI Agents
rshell, published by DataDog, is a restricted shell designed to constrain what commands AI agents can execute, using allow-lists (allowedpaths), builtins, and hooks to sandbox agent shell access. The Go-based tool aims to limit the blast radius of autonomous AI agents that are granted shell capabilities. Details →First reported github.com
GitHub - StackOneHQ/defender: Open source prompt injection protection for Agents calling tools (via MCP, CLI or direct function calling). Detect and defend against prompt injection attacks. 22MB, CPU-only, < 10ms latency.
Defender by StackOneHQ is an open-source tool that detects and defends against prompt injection attacks targeting AI agents that call tools via MCP, CLI, or direct function calling. It is described as a 22MB, CPU-only classifier with sub-10ms latency and covers both direct and indirect prompt injection. Details →First reported github.com
GitHub - onecli/onecli: Open-source credential gateway with a built-in vault. give your AI agents access to services without exposing keys.
onecli is an open-source credential gateway with a built-in vault designed to let AI agents access external services without exposing raw API keys or secrets. The GitHub project brokers credentials so agents call services through the gateway rather than holding keys directly. Details →First reported github.com
GitHub - GiovanniGatti/cve-bench: A benchmark for evaluating AI agents on fixing real-world security vulnerabilities.
cve-bench is a benchmark by GiovanniGatti for evaluating AI agents on their ability to fix real-world security vulnerabilities, shipping a Docker-based harness, results, and a write-up comparing model performance across CVEs such as CVE-2026-33175, CVE-2026-42561, CVE-2026-40864, and CVE-2026-30930. Details →First reported github.com
GitHub - prompt-security/clawsec: A complete security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw agents (and variants). Protect your SOUL.md (etc') with drift detection, live security recommendations, automated audits, and skill integrity verification. All from one installable suite.
clawsec, published by prompt-security on GitHub, is an installable security skill suite for AI coding agents (referred to as OpenClaw, Hermes, PicoClaw and NanoClaw) that provides drift detection, live security recommendations, automated audits, and skill integrity verification for agent configuration files such as SOUL.md. The repository includes automated NVD/GHSA advisory syncing and packaged, npx-installable skills for hardening agent setups. Details →First reported github.com
GitHub - dbreunig/drskill: Making sure your context is clean.
drskill is a GitHub tool by dbreunig for inspecting AI agent context and skill suites, listing configured MCP servers and their tools and generating injection review sheets to help ensure an agent's context is clean. The repo includes packaging, scripts, and MCP snapshot connection features. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported github.com
GitHub - joshfischer1108/jailbreak-lab: A hands-on kit for educational, authorized red teaming of any locally-run LLM.
jailbreak-lab (a.k.a. LLM Red Team Lab) by joshfischer1108 is a hands-on GitHub kit for educational, authorized red teaming of any locally-run, OpenAI-compatible LLM (Llama, Mistral, Qwen, Gemma, DeepSeek R1, etc.). It bundles real jailbreak techniques including instruction override, roleplay/DAN, hypothetical framing, encoding, and payload splitting. Details →First reported knostic.ai
Building openclaw-shield: Lessons Learned Securing OpenClaw Agents
Knostic has open-sourced openclaw-shield, a security plugin for OpenClaw AI agents that enforces guardrails at the tool/execution layer rather than relying on prompts or transcript scanning. It uses a 5-layer defense-in-depth approach (prompt guard, output scanner, and an execution gate requiring explicit allow/deny decisions) to stop agents from leaking secrets, exposing PII, or running destructive commands like rm -rf. Details →First reported github.com