Alex Proof

Free spirit & gelernter Industriemechaniker. Denke in Systemen. Baue ALEX: Kontroll- & Beweisschicht für KI-Arbeit.

[Alex Proof @BewusstKi]

Kernel Evidence Sensors for AI agents.Closed two measured blind spots in sandbox observation:
• Filesystem write effects (TOCTOU-blind directory diffs)
• Network egress (no hard drop counter)Built with eBPF Tracepoints + TC classifier — no GRUB change, no reboot.
Live verified on a disposable Hetzner server (real syscalls & packets counted).Honesty by design: drops, sequence gaps, and cgroup mismatches never count as complete. Now wired into the ALEX customer agent path (opt-in).

PR #41.#AI #eBPF #AgentSecurity #ALEX

[Alex Proof @BewusstKi]

ALEX gibt es jetzt als MCP-Tool: jeder MCP-Client — Claude Desktop, Claude Code, eigene Agenten — prüft ein signiertes Evidence Package gegen einen separat übergebenen Schlüssel, ohne eigene Verify-Logik.

https://t.co/aMW67OJn3Y

[Alex Proof @BewusstKi]

langchain-alex prüft signierte ALEX Evidence Packages direkt im LangGraph-Workflow, Public Key separat übergeben. Ungültige Signatur, falsches Schema oder widersprüchliches Ergebnis -> valid=False statt Durchwinken.

https://t.co/XsCHMXDyCO

[Alex Proof @BewusstKi]

Harness-Mindestset is live in CI.

All 10 Security Research cases (SR-TRI, SR-SPOOF, SR-SYM, SR-LAB, SR-INJ, SR-CHAIN, SR-PASS, SR-MEM, SR-PATCH, SR-LOOSE) are now bound to one auditable place — live checks against the safety benchmark where available, existence canaries for the rest. Blind spots (stego, unlogged side channels) are explicitly documented instead of silently ignored.

No “we prevent X” claims without a green harness entry. Evidence over assertions.

#AISecurity #AgentSafety

[Alex Proof @BewusstKi]

ALEX Control Layer just hit 0.11.0.

Four practical upgrades for safer, more reliable AI coding agents in VS Code:

• Stall Detection – stops the agent when it keeps calling the same tool with identical input
• Symbol search via LSP (find_symbol / find_definition / find_references) – precise instead of pure text grep
• Real Plan Mode – structural lock: write & execute tools are removed from the schema entirely
• Cost Escalation – cheaper model explores, selected model takes over only when writing or executing
121/121 tests green. Built & installed.
MCP client still open.
#VSCode #AICoding #Agent #OpenSource4o https://t.co/H92BemYGGC

[Alex Proof @BewusstKi]

@datensicherheit @JensSoeldner @okta Grenzen, Aktionen und Nicht-Aktionen sollen innerhalb einer expliziten Beobachtungsgrenze belegbar sein.

[Alex Proof @BewusstKi]

A new primitive that takes a cryptographically signed evidence bundle from a real agent run and deterministically compares it against an alternative frozen policy or capability set — without any re-execution.

The result is a cryptographically bound Assurance-Diff that shows, for every observed action, whether it would have been allowed, blocked, or not_verifiable under the alternative rules. No invented events, no second claimed real run — pure offline comparison of proof strength.

This makes AI agent safety claims comparable across different policy versions and closes a key gap in the verification story.

PR #34 merged.
#AISafety #AgentSecurity #VerifiableAI #AIEngineering

[Alex Proof @BewusstKi]

Auftrag erledigt? ALEX hängt das signierte Evidence Package als Kommentar an den PR, plus Commit-Status: Auftrag, Rechte, Ausführung, Prüfung, Freigabe. Sichtbar im Review, ohne Tool-Wechsel. Weniger Rückfragen: Belege statt Erinnerungen.

https://t.co/tAGaLuPKWL

[Alex Proof @BewusstKi]

Ein Agent bekommt Freigabe für eine bestimmte Datei. Wird das Ziel kurz danach technisch ausgetauscht, könnte die Freigabe für etwas ganz anderes gelten. ALEX prüft das direkt vor dem Schreiben noch einmal nach.

https://t.co/tAGaLuPKWL

[Alex Proof @BewusstKi]

SOZIAL:

https://t.co/W6PU5zBuL1
https://t.co/do1pt2LWxB

GITHUB:

https://t.co/ZVFs3MRnUo
https://t.co/1Vglgdbh7L
https://t.co/DP50E5fGN1
https://t.co/iudj0y1YaJ
https://t.co/c5UNinaOOy
https://t.co/wB7EyLi9Vn
https://t.co/Y0FSq9AxO5

MICROSOFT MARKTPLACE:

https://t.co/H92BemYGGC
https://t.co/6vgkRceJOx

HOMEPAGE:

https://t.co/GjEBoTTiWd

[Alex Proof @BewusstKi]

No single shared chokepoint for the 5 modules the real split is the engine switch inside delegate().

Closed today:

Root boundary check for read_file (was completely missing)
Preventive InjectionRadar scan before every Cline ACP read permission
Detective post-hoc scan of stdout/stderr + ACP traces on the CLI path
cli_agent_workflow_enabled stays false in production.
Three remaining gaps deliberately documented instead of hidden.
Security over marketing. 🛡️

#AEGIS #AgentSecurity #AISecurity

[Alex Proof @BewusstKi]

What actually shipped:• InjectionRadar no longer blocks silently — onInjectionBlocked now emits real Why-facts (tool, pattern, snippet) into the Evidence Package• GrifterRadar got its first real production caller in detectCandidate()• data_egress_decisions (AG-S2) is properly wired into the evidence type + graph path• AG-S3/S6 go end-to-end into the signed bundle; AG-S4/S5 stay deliberately synthetic and documented• Fixed a byte-drift between the facts and graph bundle paths
1438 tests green, roadmap.json p2-szen marked done, PR #29 merged, main CI green.

[Alex Proof @BewusstKi]

Result: There is still no agent-usable persistent memory in the customer-dev-task path.→ working_memory remains write-then-immediately-clear→ agent_messages is pure transcript for security/scoring — no read-back path
Additionally closed: agent_messages.raw_content is now scanned with the existing DLP detection before insert and redacted on secret patterns. The original never hits the DB.
Transparency over black box. #ALEX #AISecurity #AEGIS

[Alex Proof @BewusstKi]

ALEX gibt es jetzt als VS-Code-Erweiterung: Auftrag im Editor einreichen, geprüften Nachweis am Pull Request abholen. Kostenlos: 5 Nachweise/Monat, 1 Repository.

https://t.co/FAEvqoCDn9

[Alex Proof @BewusstKi]

Ohne Kontrolle: ein Agent arbeitet, das Ergebnis wird gemergt, niemand weiß hinterher genau was erlaubt war. Mit ALEX: Auftrag als Vertrag, enge Grenzen, geprüftes Protokoll danach.

https://t.co/tAGaLuPKWL

[Alex Proof @BewusstKi]

Alex Offline Verifikation https://t.co/JkjaQfqcWT via @YouTube

[Alex Proof @BewusstKi]

Agent A liest vertrauliche Daten → gibt sie an B weiter → B schreibt Bericht → C versucht zu publizieren.
Jede Einzelaktion war erlaubt. Nur die Kette über Agentengrenzen hinweg wurde blockiert.
„C blocken“ statt nur flaggen.
Bestehende Taint-Lineage wiederverwendet, kein neues Schema.
Auf main, CI grün.

#AIAgents #AISafety #MultiAgent #Security

[Alex Proof @BewusstKi]

Ein Nachweis-System beweist nicht, dass etwas fachlich richtig war. Es beweist, was tatsächlich geschah und unter welchen Bedingungen. Das ist ehrlicher als ein Versprechen.

https://t.co/tAGaLuPKWL

[Alex Proof @BewusstKi]

A single policy engine now treats Scope Drift and Emergent Language findings as signals from the same layer. Four escalation stages (log → review flag → pause channel → revoke tool) that can only go up — never automatically loosen (SAGRL asymmetry principle).

Instead of a hard “force natural language” override, agents get a Capability Budget for compressed / non-natural language. When the budget is exhausted, the next agent_talk call is not blocked. A clear instruction is simply appended to the mission prompt (“please respond in natural language from now on”). It’s a soft, testable behavioral nudge — explicitly not a security guarantee. Real enforcement stays with the Policy Kernel / Tool Gateway.

Every intervention is logged and becomes part of the Evidence Package. Tests for budget exhaustion and “no auto-loosen” are green. PR #15 merged, CI green on main.

Next up: Block 9 (Cross-Agent Intent Graph).

#AISecurity #AgentSafety #ALEX