News for hackers. Stuff that matters.

sentra

sentra on Hacker News

Execwall – firewall to stop ModelScope CVE-2026-2256 (AI agent command injectn)

Posted by sentra on Friday March 13, 2026 @07:16PM
from the self-post dept.

CVE-2026-2256 just dropped - a prompt injection in ModelScope's ms-agent allows arbitrary OS command execution. CVSS 6.5, no auth required. This is exactly why I built Execwall: an execution firewall for AI agents. The problem: AI agents that can execute code are one prompt injection away from rm -rf /. The solution: A security layer directly embedded in the shell and between app and...

( Read More... | 1 comment | on HN )
Re:just-bash: Bash for Agents on Thursday February 26, 2026 @11:31AM (#47168284)
The language choice is somewhat orthogonal to the real problem - you still need a governance layer regardless of whether agents execute bash, Python, or TypeScript.

  We built Execwall [1] to sit between the agent and the OS, enforcing argument-level policies. So you can allow git clone but deny git push, or allow chmod 644 but block chmod 777. Works with any shell or execution method.

  The key insight is that "restricted subsets" of languages still need policy enforcement at runtime - an agent can construct dangerous commands dynamically even in a sandboxed language.

  [1] https://github.com/sundarsub/execwall
Re:OpenClaw and Agent Execution Firewall on Tuesday February 24, 2026 @08:44AM (#47137095) 

  I built Sentra, an execution firewall that lets you safely run OpenClaw (AI agent with WhatsApp integration) on Oracle Cloud Free Tier for $0/month.

  The problem: AI agents that execute code are powerful but dangerous. Give an LLM shell access and it might run rm -rf /.

  The solution: A security layer with:

  • Seccomp-BPF – Kernel-level syscall filtering blocks fork, exec, ptrace before they execute

  • Policy engine – Regex-based command allowlist/denylist with argument inspection

  • Python sandbox – Namespace isolation with cgroup resource limits

  • Rate limiting – Prevents automated attack patterns

  Example:
  [sentra:enforce]$ rm -rf /
  [X] DENIED: Recursive deletion blocked

  [sentra:enforce]$ sudo su
  [X] DENIED: Privilege escalation blocked

  [sentra:enforce]$ ls -la
  total 48
  drwxr-xr-x  5 opc opc 4096 ...
   ALLOWED

  The stack (all free):

  • Oracle Cloud Free Tier – 4 ARM CPUs, 24GB RAM, 200GB storage

  • OpenClaw – Node.js AI agent framework with WhatsApp Web

  • Sentra – Rust execution firewall (this project)

  • Any LLM via OpenRouter (Gemini, GPT-4, Claude, Llama)

  One-line install:
  curl -sSL https://raw.githubusercontent.com/sundarsub/sentra/main/scripts/install-oracle-cloud.sh | sudo bash

  Links:

  • GitHub: https://github.com/sundarsub/sentra

  • Oracle Cloud Guide: https://github.com/sundarsub/sentra/blob/main/docs/ORACLE_CLOUD_DEPLOYMENT.md

  Open source (Apache-2.0). [email protected]