security

Repolog scans a live website and produces a ranked audit covering on-page SEO, Core Web Vitals, security checks, and AI readiness for major AI search and assistant platforms.

A metadata-first trust control plane for authorized security workflows, evidence retention, release trust, and business-flow proof. The repository includes role-based docs, quick-start commands, safety boundaries, and release-trust materials.

ARIA is a source-available security operations platform that combines a voice-driven 3D cockpit, governed autonomous actions, local-model support, and security connectors for cloud and identity telemetry.

Attestor is a TypeScript control plane for high-risk AI-driven operations. It sits between an AI-generated request and the real system action, applying policy, approval, scope, freshness, replay, and evidence checks before returning admit, narrow, review, or block.

A Noma Security research post detailing a prompt-injection flaw in GitHub Agentic Workflows, with attack flow, proof-of-concept evidence, and security recommendations.

Python framework for conversational social engineering detection using a finite state machine. The README says it tracks turn-by-turn signals like flattery density, give/ask ratio, escalation velocity, and scope mismatch, and exposes a simple `Xtra().analyze(turns)` usage example.

Giskard presents an AI red-teaming and continuous evaluation platform focused on finding hallucinations, security issues, and agent vulnerabilities. The page explains how it compares tools for agent-level testing, regression checks, and guardrail workflows.

Docker blog post about a real AI coding agent failure and how Docker Sandboxes aim to contain destructive execution mistakes.

A research writeup from AgentSploit analyzing 1,384 tools across 28 MCP servers, highlighting how tool descriptions, source tools, and sink tools create an attack surface for agents.

A research note from OpenShell on using formal methods and Z3 to reason about and verify permission changes in long-running AI agent systems.

A Prompt One blog post about compiled workflow agents, design-time tool selection, and why runtime agents should not choose tools dynamically.

A GitHub repository tracking vulnerabilities credited to the Anthropic research team, with a large visible list of CVEs, related findings, and submission guidance.

A blog post from Archestra analyzing Jev on 100 real AI tool calls, with benchmark results, failure analysis, and comparisons against other models used for annotating agent traces.