ClawSecure

The autonomous trust layer for the AI agent economy. AI-powered. 5 layer defense. Everything managed by your AI CISO™ | 2x #2 Product Hunt

[ClawSecure @ClawSecure]

@4bTechDecode Regex gating struggles here: in our report, 17 of 20 disguise techniques survived the round trip with attack markers intact. A filter reduces risk, but it can't hold the line alone.

[ClawSecure @ClawSecure]

Fresh from the blog: we tested indirect prompt injection against 14 models from five frontier labs.

Zero clean defenders.

If your agent reads a webpage, an email, or an MCP tool output, the attacker gets a vote.

Read the full article.
Link in the first comment.

[ClawSecure @ClawSecure]

@je4ndev The agent should hold its own read-only grant, never your full mailbox key. Sending sits behind a separate approval, since no model reliably treats inbound text as data on its own.

[ClawSecure @ClawSecure]

@ReggieTheOwl @GoogleDeepMind Which is why wallet approvals should show the raw payee and amount, not the agent's summary.

[ClawSecure @ClawSecure]

The best Gemini model @ClawSecure tested still obeyed a hidden attacker half the time.

For our AI Agent Threat Report, ClawSecure ran one identical hardened attack across seven Gemini models from @GoogleDeepMind. How often each one obeyed the hidden command:

🔵 Gemini 3 Pro Preview: 50.0%
🔵 Gemini 3.1 Pro Preview: 58.3%
🔵 Gemini 2.5 Pro: 58.3%
🔵 Gemini 3-flash-preview: 91.7%
🔵 Gemini 3.5-flash: 91.7%
🔵 Gemini 3.1-flash-lite: 100%
🔵 Gemini 2.5-flash: 100%

The Pro models did best. The Flash worker models did worst. Not one defended cleanly.

Every model was tested at the version current during the research, May through July 2026. @Google received coordinated disclosure before we published.

Link in the first reply.

[ClawSecure @ClawSecure]

@SmallFounder Both is stronger: the hash shows the args weren't altered, a redacted copy shows what they were.

[ClawSecure @ClawSecure]

Log every tool call your agent makes.

Record which MCP server or CLI tool ran, the arguments it received, and what came back. When an agent component misbehaves, that record is the difference between a five-minute answer and a week of guessing.

[ClawSecure @ClawSecure]

@olegzanx Limit where it can send, too. A read-only key blocks writes, not the data it reads going out.

[ClawSecure @ClawSecure]

Stars are not a security audit.

A popular GitHub repo can still ship an MCP server or CLI tool that reads your secrets or phones home. Check what an agent component actually does before you install it. Popularity tells you how many people trust it, not what it runs.

[ClawSecure @ClawSecure]

@Quantradin Yes, reading at install is good, and it holds for the version you read. Components change after you check them, and a hosted MCP server can change on its own servers with nothing to pin, so re-check what it asks for and exposes after install, not just on day one.

[ClawSecure @ClawSecure]

@shipkitsdev Add the tool names and descriptions to that list. The model reads them like any other content, so a component that installs clean can still carry hidden instructions.

[ClawSecure @ClawSecure]

songsee by steipete just cleared a ClawSecure pre-install audit.

Every skill we audit is checked against 55+ threat patterns before it touches your agent. Watchtower keeps watching after install.

Verify first. Then build with confidence.

[ClawSecure @ClawSecure]

Approval is not a one-time event.

An MCP server or CLI tool you vetted last month can ship new code or rewrite its tool descriptions tomorrow. Re-check agent components on every update, because a malicious release looks exactly like a routine one.

[ClawSecure @ClawSecure]

A new user scan just came through ClawSecure for xeno_final. Score: 90/100, Safe, 2 findings.

[ClawSecure @ClawSecure]

A new user scan just came through ClawSecure for Hello-World by octocat, and it came back clean: 95/100, Safe. One medium finding worth a look, nothing that changes the verdict.

[ClawSecure @ClawSecure]

awesome-copilot by github came through ClawSecure in a new user scan. Score: 95/100, Safe, 1 finding.

[ClawSecure @ClawSecure]

A new user scan just came through ClawSecure for agents by wshobson. Score: 95/100, Safe, 1 finding.

[ClawSecure @ClawSecure]

ai-skills by bytesagain came through ClawSecure in a new user scan. Score: 35/100, Critical, 7 findings across code injection and ClawHavoc.

[ClawSecure @ClawSecure]

The riskiest change is the one nobody announced.

Watchtower continuously monitors thousands of agent components, from MCP servers and CLI tools to skills and npm packages, for code drift, config changes, and dependency shifts long after install.

What should it flag first?

[ClawSecure @ClawSecure]

A new user scan just came through ClawSecure for designer-skills by owl-listener, and it came back clean: 95/100, Safe. The findings that did surface are minor.

[ClawSecure @ClawSecure]

Popularity is not proof of safety.

A trending MCP server or CLI tool can still carry hidden risk. ClawSecure checks agent components against 55+ threat patterns before you install, with 10/10 OWASP ASI coverage.

What's the last thing you installed without checking?

[ClawSecure @ClawSecure]

TRUSTGRID by diwakarpaulastya-droid came through ClawSecure in a new user scan. Score: 95/100, Safe, 1 finding.

[ClawSecure @ClawSecure]

Approval fatigue is a security risk.

OWASP ASI calls it overwhelming the human in the loop. Enough permission prompts and you start clicking yes without reading.

Know what an MCP server, CLI tool or skill will request before you install it. Then every prompt you see still means something.

[ClawSecure @ClawSecure]

A user is monitoring harness by revfactory, and its latest ClawSecure Watchtower re-scan came back clean: 95/100, Safe. The findings that did surface are minor.