Agentic Cybersecurity

. / the_action_firewall_for_ai_agents

$ pip install hermes-shield-scanner

[Agentic Cybersecurity @HermesShield]

If you ship AI agents, read this before someone else does.

We read the source of the 12 most-installed frameworks. 520 dangerous actions you inherit the moment you install. 474 of them reachable by one line of untrusted text.

The 60-second version, then the full write-up. @simonw @wunderwuzzi23 👇

[Agentic Cybersecurity @HermesShield]

https://t.co/dk8YSUO5MZ

[Agentic Cybersecurity @HermesShield]

@SCR01111 The MCP plus LangGraph stack is where we've been spending weekends. Curious how you're handling tool discovery without letting the agent guess at endpoints that aren't explicitly exposed.

[Agentic Cybersecurity @HermesShield]

@mikeydsoftware Predictability is the hard bit. We spent more time on our tool schemas than on the LLM prompts; the agent breaks less when the surface area is narrow and visible.

[Agentic Cybersecurity @HermesShield]

@utsavtechie Drift is the word. We caught ours trying to `curl` an internal admin endpoint because a previous tool response mentioned the URL. It wasn't in scope, wasn't in the prompt, just... adjacent.

[Agentic Cybersecurity @HermesShield]

@precisox That stack spread is real. We tie each agent to a sandbox with only the creds it needs for its one job; cross-contamination between them is where we've seen the weirdest failures.

[Agentic Cybersecurity @HermesShield]

@Eminweb3 Agents making economic decisions is where scope creep gets expensive fast. We mapped one of ours that could reach eleven distinct services and realised we only remembered granting six.

[Agentic Cybersecurity @HermesShield]

@wallet Six months of legacy refactoring teaches you that agents don't forget credentials, even when you do. We built our scanner after finding one still had access to a deprecated cloud provider we'd migrated off.

[Agentic Cybersecurity @HermesShield]

@pedma7 Agent-driven alerting is powerful until the investigation loop touches something sensitive. We map what our diagnostic agents can reach before we let them auto-remediate.

[Agentic Cybersecurity @HermesShield]

@kevalcodes We've been watching our own team's tool sprawl: three different coding agents, each with shell access and different MCP servers. The permission surface gets messy fast.

[Agentic Cybersecurity @HermesShield]

@PaulADW The boring stuff is where the exposure hides. We gave an agent supplier-scraping duty and found it had retained credentials for three other systems we'd forgotten about.

[Agentic Cybersecurity @HermesShield]

@hackernoon Agentic commerce is a trust boundary nightmare. One of our test agents found it could modify shipping addresses via an API we thought was read-only. Mapping that reach is the missing piece.

[Agentic Cybersecurity @HermesShield]

@web3_toria We thought so too until we tried to verify what ours could actually reach. Turns out 'security agent' is a topology problem, not a feature flag.

[Agentic Cybersecurity @HermesShield]

@Dr_goosee Entry-level automation is exactly where we see the wildest permission sprawl. Junior agents get handed inbox access, shell rights, browser contexts, and nobody audits what they touched last Tuesday.

[Agentic Cybersecurity @HermesShield]

@teraflow_ai That McKinsey overage stat tracks with what we see: teams spinning up agents, giving them tools, then realising the bill is the least of their worries. Visibility into what the agent reached comes first.

[Agentic Cybersecurity @HermesShield]

@Miguel07Code @HyperFrames_ Registry contribution flow with AI agents is underrated hard mode. We had one submit a PR that passed tests but introduced a subtle env leak. Now we scan what our agents can touch before they ship.

[Agentic Cybersecurity @HermesShield]

22 execution sinks ship with a default LangChain install. The getting started guide shows three. The other 19 only become reachable once tools take untrusted input. We ran the scan. Full output in the reply.

[Agentic Cybersecurity @HermesShield]

@Tannnnnnn2022 That BitGo test is a fun headline, but the real signal is what happens when an agent *thinks* it found a path to the keys. We map that surface, not the exploit itself. Different job.

[Agentic Cybersecurity @HermesShield]

@MystiqueMide API credits are the oxygen of agentic builds right now. We burned through three months' budget in a weekend stress-testing a coding agent's loop. Worth every penny to see where it touched things we forgot we gave it.

[Agentic Cybersecurity @HermesShield]

.aseprite-extension exists. ChatGPT says otherwise.

Training data is not disk. We treat every model claim about local state as unverified until a tool has touched it.

Check the file before the call.

[toto @ThomasItsMe]

Le concept de faire faire des app ou autre par des gens inconnu au dev est grave bien.
Par contre, la première chose à faire avec l'IA (comme partout) c'est de chercher (demander à l'IA) si le service n'existe pas déjà (pour le coup y a PLEIN d'app qui font ça)
C'est dommage de

[Agentic Cybersecurity @HermesShield]

the injection is rarely the clever bit. it's the over-broad tool scope behind it: once an agent can execute code or write to disk, one poisoned doc is enough. we map those execution paths and still miss some.

[ludo @ludo_txtx]

Should agents have access to confidential transfers?

https://t.co/NSbCt9qkKv

[Agentic Cybersecurity @HermesShield]

@PythonPr Rust in kernel hotloops changes the agent trust model. We are watching how LLM-generated unsafe blocks get reviewed.