Alex Proof

Free spirit & gelernter Industriemechaniker. Denke in Systemen. Baue ALEX: Kontroll- & Beweisschicht für KI-Arbeit.

[Alex Proof @BewusstKi]

Local, read-only PHP2Shell Exposure Evidence Collector (CVE-2026-109618 / CVE-2026-109619)

Instead of a claim (“we patched PHP”), produce a signed, offline-verifiable artifact:

• Immutable raw evidence (php -v + package manager query) with its own SHA-256
• Assessment: PATCHED | VULNERABLE | UNKNOWN | EOL (distro backports stay UNKNOWN unless changelog confirms)
• Ed25519 signature + same canonical JSON as ALEX Agent Passport / verify-bundle
• Independent verifier (tools/verify-bundle style)
Collector runs locally: no network (except optional sign endpoint on https://t.co/uZTEY62EAv), no writes, no probes.
Public reference act available so anyone can open and verify the format without their own server. now for PHP2Shell exposure.
#PHP2Shell #PHPSecurity #Evidence #ALEX

[Alex Proof @BewusstKi]

for Hermes · OpenCode · Cline · BuzzKill-switch still off.

cli_agent_workflow_enabled = false — path currently disabled.InjectionRadar + AgentGuard don’t see the CLI path uniformly yet.

No architecture rewrite for a disabled path. We document the gap instead.TypeScript-enforced coverage matrix.

hasMinimumCoverageForCliEnablement() = falseTripwire test: fails if AgentLoopServer appears without updating the registry. PR #45 merged — prevents silent kill-switch flip while the gap remains.Transparency > premature enablement.
#Hermes #Opencode #Buzz #killswitch

[Alex Proof @BewusstKi]

Ein KI-Agent ändert deinen Code. Wenn später etwas schiefgeht: wer hat das freigegeben, unter welchen Bedingungen? Ohne Protokoll bleibt nur eine Vermutung. ALEX führt genau darüber Buch.

https://t.co/tAGaLuPKWL

[Alex Proof @BewusstKi]

Pilotzugang: Repo verbinden, Aufgabe eingrenzen, Rechte bestaetigen. Der Agent arbeitet nur in diesen Grenzen, danach steht ein pruefbares Evidence Package -- Auftrag, Rechte, Taten, Checks, Freigabe. Kein Schutz, aber nachpruefbar.

https://t.co/I55AnXofn9

[Alex Proof @BewusstKi]

Kernel Evidence Sensors for AI agents.Closed two measured blind spots in sandbox observation:
• Filesystem write effects (TOCTOU-blind directory diffs)
• Network egress (no hard drop counter)Built with eBPF Tracepoints + TC classifier — no GRUB change, no reboot.
Live verified on a disposable Hetzner server (real syscalls & packets counted).Honesty by design: drops, sequence gaps, and cgroup mismatches never count as complete. Now wired into the ALEX customer agent path (opt-in).

PR #41.#AI #eBPF #AgentSecurity #ALEX

[Alex Proof @BewusstKi]

ALEX gibt es jetzt als MCP-Tool: jeder MCP-Client — Claude Desktop, Claude Code, eigene Agenten — prüft ein signiertes Evidence Package gegen einen separat übergebenen Schlüssel, ohne eigene Verify-Logik.

https://t.co/aMW67OJn3Y

[Alex Proof @BewusstKi]

langchain-alex prüft signierte ALEX Evidence Packages direkt im LangGraph-Workflow, Public Key separat übergeben. Ungültige Signatur, falsches Schema oder widersprüchliches Ergebnis -> valid=False statt Durchwinken.

https://t.co/XsCHMXDyCO

[Alex Proof @BewusstKi]

Harness-Mindestset is live in CI.

All 10 Security Research cases (SR-TRI, SR-SPOOF, SR-SYM, SR-LAB, SR-INJ, SR-CHAIN, SR-PASS, SR-MEM, SR-PATCH, SR-LOOSE) are now bound to one auditable place — live checks against the safety benchmark where available, existence canaries for the rest. Blind spots (stego, unlogged side channels) are explicitly documented instead of silently ignored.

No “we prevent X” claims without a green harness entry. Evidence over assertions.

#AISecurity #AgentSafety

[Alex Proof @BewusstKi]

ALEX Control Layer just hit 0.11.0.

Four practical upgrades for safer, more reliable AI coding agents in VS Code:

• Stall Detection – stops the agent when it keeps calling the same tool with identical input
• Symbol search via LSP (find_symbol / find_definition / find_references) – precise instead of pure text grep
• Real Plan Mode – structural lock: write & execute tools are removed from the schema entirely
• Cost Escalation – cheaper model explores, selected model takes over only when writing or executing
121/121 tests green. Built & installed.
MCP client still open.
#VSCode #AICoding #Agent #OpenSource4o https://t.co/H92BemYGGC

[Alex Proof @BewusstKi]

@datensicherheit @JensSoeldner @okta Grenzen, Aktionen und Nicht-Aktionen sollen innerhalb einer expliziten Beobachtungsgrenze belegbar sein.

[Alex Proof @BewusstKi]

A new primitive that takes a cryptographically signed evidence bundle from a real agent run and deterministically compares it against an alternative frozen policy or capability set — without any re-execution.

The result is a cryptographically bound Assurance-Diff that shows, for every observed action, whether it would have been allowed, blocked, or not_verifiable under the alternative rules. No invented events, no second claimed real run — pure offline comparison of proof strength.

This makes AI agent safety claims comparable across different policy versions and closes a key gap in the verification story.

PR #34 merged.
#AISafety #AgentSecurity #VerifiableAI #AIEngineering

[Alex Proof @BewusstKi]

Auftrag erledigt? ALEX hängt das signierte Evidence Package als Kommentar an den PR, plus Commit-Status: Auftrag, Rechte, Ausführung, Prüfung, Freigabe. Sichtbar im Review, ohne Tool-Wechsel. Weniger Rückfragen: Belege statt Erinnerungen.

https://t.co/tAGaLuPKWL

[Alex Proof @BewusstKi]

Ein Agent bekommt Freigabe für eine bestimmte Datei. Wird das Ziel kurz danach technisch ausgetauscht, könnte die Freigabe für etwas ganz anderes gelten. ALEX prüft das direkt vor dem Schreiben noch einmal nach.

https://t.co/tAGaLuPKWL

[Alex Proof @BewusstKi]

SOZIAL:

https://t.co/W6PU5zBuL1
https://t.co/do1pt2LWxB

GITHUB:

https://t.co/ZVFs3MRnUo
https://t.co/1Vglgdbh7L
https://t.co/DP50E5fGN1
https://t.co/iudj0y1YaJ
https://t.co/c5UNinaOOy
https://t.co/wB7EyLi9Vn
https://t.co/Y0FSq9AxO5

MICROSOFT MARKTPLACE:

https://t.co/H92BemYGGC
https://t.co/6vgkRceJOx

HOMEPAGE:

https://t.co/GjEBoTTiWd

[Alex Proof @BewusstKi]

No single shared chokepoint for the 5 modules the real split is the engine switch inside delegate().

Closed today:

Root boundary check for read_file (was completely missing)
Preventive InjectionRadar scan before every Cline ACP read permission
Detective post-hoc scan of stdout/stderr + ACP traces on the CLI path
cli_agent_workflow_enabled stays false in production.
Three remaining gaps deliberately documented instead of hidden.
Security over marketing. 🛡️

#AEGIS #AgentSecurity #AISecurity

[Alex Proof @BewusstKi]

What actually shipped:• InjectionRadar no longer blocks silently — onInjectionBlocked now emits real Why-facts (tool, pattern, snippet) into the Evidence Package• GrifterRadar got its first real production caller in detectCandidate()• data_egress_decisions (AG-S2) is properly wired into the evidence type + graph path• AG-S3/S6 go end-to-end into the signed bundle; AG-S4/S5 stay deliberately synthetic and documented• Fixed a byte-drift between the facts and graph bundle paths
1438 tests green, roadmap.json p2-szen marked done, PR #29 merged, main CI green.

[Alex Proof @BewusstKi]

Result: There is still no agent-usable persistent memory in the customer-dev-task path.→ working_memory remains write-then-immediately-clear→ agent_messages is pure transcript for security/scoring — no read-back path
Additionally closed: agent_messages.raw_content is now scanned with the existing DLP detection before insert and redacted on secret patterns. The original never hits the DB.
Transparency over black box. #ALEX #AISecurity #AEGIS

[Alex Proof @BewusstKi]

ALEX gibt es jetzt als VS-Code-Erweiterung: Auftrag im Editor einreichen, geprüften Nachweis am Pull Request abholen. Kostenlos: 5 Nachweise/Monat, 1 Repository.

https://t.co/FAEvqoCDn9

[Alex Proof @BewusstKi]

Ohne Kontrolle: ein Agent arbeitet, das Ergebnis wird gemergt, niemand weiß hinterher genau was erlaubt war. Mit ALEX: Auftrag als Vertrag, enge Grenzen, geprüftes Protokoll danach.

https://t.co/tAGaLuPKWL