security

HookGuard is a CLI security scanner for AI coding agent configuration files. It looks for malicious hooks, invisible Unicode, credential exfiltration patterns, and prompt-injection text in files like CLAUDE.md, AGENTS.md, Cursor rules, and GitHub Copilot instructions.

A public security leaderboard for AI coding agents, showing 9 benchmark tests across multiple harness versions with dates, outcomes, disclosures, and re-test status.

HDTP is a protocol specification for agent-to-agent communication on behalf of people, centered on certificates, contact approval, per-caller permissions, and sealed end-to-end calls.

A public timeline and dataset of notable AI-involved hacking and cyber incidents, with RSS support and source links for each entry.

ContextVeil is an open-source tool that redacts enrolled secret values locally before coding agents send text to an LLM. It keeps files and commands usable while replacing exact secret matches with placeholders.

A browser extension that masks personal and sensitive information before you send messages to AI chat tools, then restores the original values in the reply.

A blog post describing Annex, a local-AI security tool that encrypts selected files during agent sessions to keep sensitive data away from local AI tools. The post explains the threat model, encryption flow, and the stack used to build it.

Code Airlock is a wrapper for running coding agents like Claude Code and Codex inside disposable microVMs, with changes committed to git for host-side review.

git-lrc is a Git-based AI code review tool that runs on commit and surfaces risk categories, inline findings, and a summary deck for each review.

Local-first governance layer for AI systems that monitors prompts and responses to block secrets, PII, and runaway LLM spending before requests leave the machine.

Blue41 is an enterprise risk control platform for AI agents. The site says it monitors agent behavior in production, detects prompt-injection-style incidents and unauthorized activity, and helps teams control sensitive workflows and compliance risk.

A Blue41 case study on how a banking AI assistant could be abused through indirect prompt injection, and what mitigation layers help reduce the risk.

Chrome extension that brings AI coding help directly into the browser for debugging, code explanations, security reviews, and solution generation.

Open-source Python DDoS traffic monitor that prints live traffic stats to stdout and can output JSON for pipelines and tooling.

A survey of eight tools that sit between AI agents and the services they call, covering credential injection, interception, policy enforcement, and mocking/testing. The page explains what each tool is for, where it fits, and what to watch out for.

A weekly security audit of Atlassian’s remote MCP server, focused on OAuth 2.1, RFC 9728 discovery, PKCE, DCR, and token handling. The page documents why the server’s discovery chain fails and includes HTTP evidence links.

A Docker-based sandbox for running AI coding agents with dropped capabilities, no-new-privileges, and no Docker socket access. It wraps the pi terminal coding agent and supports local file edits, persistent auth, and skills mounts.

Experimental observability tooling for Go services that turns vulnerability scanning into live metrics. It combines govulncheck, Prometheus, and OpenTelemetry to show when vulnerable code is actually executing in running services.

Local-first coding agent workbench that runs agents in secretless microVMs, with support for multiple providers, parallel sessions, and shared repository workflows.

A curated dataset of sandboxes and related approaches for running AI coding agents with isolation, network control, or credential mediation.

A Claude Code-based operating system for running executive workflows across research, communications, CRM, content, and operations, with a split between a public engine repo and a private data repo.

A GitHub Copilot port of Anthropic’s vulnerability discovery harness, with Copilot skills for threat modeling, scanning, triage, patching, and an autonomous sandboxed pipeline for C/C++ memory-safety bug discovery and remediation.

A security-focused article about a Git configuration attack path affecting multiple AI coding agents, with concrete reproduction details and vendor response notes. It also introduces grith, described as an OS-level security proxy for AI coding agents.

A public showcase for Mangudai, an external attack surface management and vulnerability management platform for small security teams. The page describes architecture, scan modules, pricing tiers, and the intended SaaS workflow, making it suitable for a directory listing.