LuD1161

I've been working on something similar , policy guardrails for coding agents, with OPA backed policies and os-native sandbox - https://github.com/LuD1161/agentjail

I just checked the repo. Nice work A suggestion: 1. Adding which repo/project was where my most tokens were consumed. I checked the image in the repo README, didn't see that graph.

wow i need to check the 32GB cards. how did you handle the KV cache. Oh i see it was the Q6 model. Did you have to cut down on context window?

Hey thanks for the question. I would like to answer it in a more descriptive manner with an example later.

Classifying a command can be a bit of a misnomer because it has two inherent problems:

1. You need a classifier. That means the security boundary becomes “can I trick or bypass the classifier?” Whether it is a smaller model or a pile of regexes, it will eventually have edge cases.

2. The token economics do not work, and it also needs to be fast. I do not want an eval evaluating another eval for every command.

So the approach I took is closer to how we normally build security systems: secure defaults and deterministic boundaries.

For example, to protect secrets, AgentJail can block access to paths like `~/.ssh`, `~/.aws/credentials`, `.env`, etc. at the OS level.

The OS is the deterministic boundary here. The ring-0 enforcement layer.

The more interesting problem is network access. You may genuinely want the agent to debug a production Kubernetes cluster, inspect an AWS resource, or query a production database. A blanket network deny would make the agent useless.

For that, I am taking a protocol-aware DSL approach. Something like:

``` deny if { request.host == "api.github.com" request.method == "POST" startswith(request.path, "/repos/") endswith(request.path, "/git/refs") }

ask if { request.host == "kubernetes.default.svc" request.method == "DELETE" }

allow if { request.host == "api.github.com" request.method == "GET" } ```

So instead of trying to classify whether a command is “dangerous,” the policy describes exactly which resources and operations are allowed, denied, or require approval.

The agent can still be probabilistic. The enforcement boundary should not be.

Does that answer to your question?

You mean, I should stop posting much about it ? Is it too aggressive posting Am sorry about that.

With agentjail ( https://github.com/LuD1161/agentjail ), I've tried to contain coding agents in os-native sandboxes (sbpl for macos and similarly for linux, <4ms start time) + policy guardrails evaluated by Open Policy Agent (OPA), policies written in rego.

Protocol aware network proxy coming soon Then you can match a DSL and block particular network requests.

This ensures you no longer fear --dangerously-skip-permissions and stop babysitting agents

What else would you want to see in this project? Please star the repo, if you like the idea :)

With agentjail (github.com/LuD1161/agentjail), I've tried to contain coding agents in os-native sandboxes (sbpl for macos and similarly for linux) + policy guardrails evaluated by Open Policy Agent (OPA), policies written in rego.

Protocol aware network proxy coming soon Then you can match a DSL and block particular network requests.

This ensures you no longer fear --dangerously-skip-permissions and stop babysitting agents

What else would you want to see in this project? Please star the repo, if you like the idea :)

Policy guardrails for Coding Agents. Never babysit your agents - github.com/lud1161/agentjail

· OS native sandbox (<4ms start-time) · Policies for AWS, local files, k8s, DBs etc. · Rego backed policies w/ OPA (CNCF Graduated project) · Fastest policy evaluator (<3ms)

Please star the repo if you like the work.

Might wanna check out https://github.com/LuD1161/agentjail - policy guardrails for coding agents.

shameless self-plug. I've been dogfooding it for the last 3 weeks now.

Dont trust your production data with a markdown file. Have deterministic guardrails

Thanks !

For now I am parsing the text only. Testing app for real instances would be fun and a dedicated project in itself. I've some ideas, hit me up if you're interested or can collab if you're doing it already.

wow. this is such an interesting perspective. hadn't thought so deeply about my 'shower thought'. This expands my horizon. Might put this into the update. When I was thinking about it, the fleeting thought was majorly about the 'newness effect' which isn't related to a subjective liking of something but is pervasive across everything, whether it be tech, music, movies etc.

Thanks for sharing this.

A friend said KubeCon "isn't the same anymore." I asked what got worse. They couldn't answer. Turns out there's a name for this.

Three names, actually: 1. Hedonic Adaptation : Brain's inbuilt boredom machine 2. Rosy Retrospection : Your Memory is a Highlight Reel 3. Declinism : The "Kids These Days" Bias

I found an Insecure Direct Object Reference(IDOR0 security issue that led to leaking GST challans (receipts) of all the 11.8M registered taxpayers. Here's the full story alongwith a video PoC.

Note: No personal data was ever shared or harvested. This was responsibly disclosed to the authorities through proper channels and only after the disclosure timeline (120 days) was it published in the online media.

I've started this series on online privacy to teach people some of the good online cybersecurity hygiene, that can help them keep safe.

This is my first attempt at recreating a bug from its test case, feedback is highly appreciated.

RCE in git By cloning a repo - 'git clone --recursive <git_repo>' , your machine could be compromised. Works on MacOS and Windows Fix - Upgrade git Technical walkthrough and how you can reproduce it

Not expected this from a security company :P Please fix/update your certs :)

``` https://foundationalsec.com/

Unable to communicate securely with peer: requested domain name does not match the server’s certificate.

HTTP Strict Transport Security: false

HTTP Public Key Pinning: false

```

Screenshot here -> https://postimg.cc/gallery/cdQsCzd

In this blog we will see a step-by-step guide of what goes behind a successful pentest. This not only includes the technical aspects but also the business and legal aspects of it.

If you’re tasked with the responsibility for getting your organisation's app or website's pentest done, this blog would definitely help you navigate the waters easily.

Hello Everyone Back with another #exploitation 4th part in the #GraphQL Exploitation series -

1⃣ Deep Recursion Attack - Attack & Defend (max depth)

2⃣ GraphQL Introspection

Thanks to Dolev Farhi for the awesome DVGA

#bugbounty #cybersecurity

SEEKING WORK | Remote : Yes | Location: India

Area of expertise : App Security ( Web & Mobile ), Infrastructure Security etc.

Technologies: Python, Go, Terraform, AWS, GCP, Vault, CIS Benchmarks, Docker, kubernetes ( k8s ), gitlab CI/CD & github actions, Jenkins, ELK

Résumé/CV: https://aseemshrey.in/resume.html

Email: [email protected]

Blog : https://aseemshrey.in/

YouTube : HackingSimplified : https://www.youtube.com/channel/UCARsgS1stRbRgh99E63Q3ng

I build scalable security solutions as well, for my current employer as well as in a previous startup where I built a lot of systems from scratch.

I teach on my youtube channel hackingsimplified , about cybersecurity stuff.

Available for consulting as well.

Location: India

Remote: Yes

Willing to relocate: Yes

Technologies: Python, Go, Terraform, AWS, GCP, Vault, CIS Benchmarks, Docker, kubernetes ( k8s ), gitlab CI/CD & github actions, Jenkins, ELK

Résumé/CV: https://aseemshrey.in/resume.html

Email: [email protected]

Blog : https://aseemshrey.in/

YouTube : HackingSimplified : https://www.youtube.com/channel/UCARsgS1stRbRgh99E63Q3ng

My area of expertise App Security ( Web & Mobile ), Infrastructure Security etc.

I build scalable security solutions as well, for my current employer as well as in a previous startup where I built a lot of systems from scratch.

I teach on my youtube channel hackingsimplified , about cybersecurity stuff.

Available for consulting as well.