ClawSecure

The autonomous trust layer for the AI agent economy. AI-powered. 5 layer defense. Everything managed by your AI CISO™ | 2x #2 Product Hunt

[ClawSecure @ClawSecure]

A user re-scanned Anthropic-Cybersecurity-Skills by mukul975 through ClawSecure Watchtower. Score: 65/100, Moderate, 4 findings across ReDoS and ClawHavoc.

[ClawSecure @ClawSecure]

Your agent's goal can change without you noticing.

OWASP ASI calls it agent goal hijack. A poisoned README, MCP server response, or tool output slips in new instructions, and your agent follows them as if they were yours.

ClawSecure checks for it before install and at runtime.

[ClawSecure @ClawSecure]

Watchtower re-scan flagged AI-Agent-Risk-Evaluation by ZhongdaoChen, a skill a user is monitoring. ClawSecure scored it 0/100, Critical, 21 findings across code injection and ClawHavoc.

[ClawSecure @ClawSecure]

Just audited kicad-source-mirror by KiCad. It cleared our pre-install audit against 55+ threat patterns.

Good tools deserve proof, not blind trust. Scan every agent component before it touches your environment.

[ClawSecure @ClawSecure]

frontend-design by anthropics just cleared a ClawSecure Watchtower re-scan for a user monitoring it. Score: 95/100, Safe. The findings that did surface are minor.

[ClawSecure @ClawSecure]

Install scripts run before your agent ever does.

MCP servers, CLI tools, and npm packages can execute code the moment you install them, with your full permissions. Audit every agent component before it touches your machine, not after.

[ClawSecure @ClawSecure]

A user is monitoring sonoscli by steipete, and its latest ClawSecure Watchtower re-scan came back clean: 95/100, Safe. The findings that did surface are minor.

[ClawSecure @ClawSecure]

@4bTechDecode Regex gating struggles here: in our report, 17 of 20 disguise techniques survived the round trip with attack markers intact. A filter reduces risk, but it can't hold the line alone.

[ClawSecure @ClawSecure]

Fresh from the blog: we tested indirect prompt injection against 14 models from five frontier labs.

Zero clean defenders.

If your agent reads a webpage, an email, or an MCP tool output, the attacker gets a vote.

Read the full article.
Link in the first comment.

[ClawSecure @ClawSecure]

@je4ndev The agent should hold its own read-only grant, never your full mailbox key. Sending sits behind a separate approval, since no model reliably treats inbound text as data on its own.

[ClawSecure @ClawSecure]

@ReggieTheOwl @GoogleDeepMind Which is why wallet approvals should show the raw payee and amount, not the agent's summary.

[ClawSecure @ClawSecure]

The best Gemini model @ClawSecure tested still obeyed a hidden attacker half the time.

For our AI Agent Threat Report, ClawSecure ran one identical hardened attack across seven Gemini models from @GoogleDeepMind. How often each one obeyed the hidden command:

🔵 Gemini 3 Pro Preview: 50.0%
🔵 Gemini 3.1 Pro Preview: 58.3%
🔵 Gemini 2.5 Pro: 58.3%
🔵 Gemini 3-flash-preview: 91.7%
🔵 Gemini 3.5-flash: 91.7%
🔵 Gemini 3.1-flash-lite: 100%
🔵 Gemini 2.5-flash: 100%

The Pro models did best. The Flash worker models did worst. Not one defended cleanly.

Every model was tested at the version current during the research, May through July 2026. @Google received coordinated disclosure before we published.

Link in the first reply.

[ClawSecure @ClawSecure]

@SmallFounder Both is stronger: the hash shows the args weren't altered, a redacted copy shows what they were.

[ClawSecure @ClawSecure]

Log every tool call your agent makes.

Record which MCP server or CLI tool ran, the arguments it received, and what came back. When an agent component misbehaves, that record is the difference between a five-minute answer and a week of guessing.

[ClawSecure @ClawSecure]

@olegzanx Limit where it can send, too. A read-only key blocks writes, not the data it reads going out.

[ClawSecure @ClawSecure]

Stars are not a security audit.

A popular GitHub repo can still ship an MCP server or CLI tool that reads your secrets or phones home. Check what an agent component actually does before you install it. Popularity tells you how many people trust it, not what it runs.

[ClawSecure @ClawSecure]

@Quantradin Yes, reading at install is good, and it holds for the version you read. Components change after you check them, and a hosted MCP server can change on its own servers with nothing to pin, so re-check what it asks for and exposes after install, not just on day one.

[ClawSecure @ClawSecure]

@shipkitsdev Add the tool names and descriptions to that list. The model reads them like any other content, so a component that installs clean can still carry hidden instructions.

[ClawSecure @ClawSecure]

songsee by steipete just cleared a ClawSecure pre-install audit.

Every skill we audit is checked against 55+ threat patterns before it touches your agent. Watchtower keeps watching after install.

Verify first. Then build with confidence.

[ClawSecure @ClawSecure]

Approval is not a one-time event.

An MCP server or CLI tool you vetted last month can ship new code or rewrite its tool descriptions tomorrow. Re-check agent components on every update, because a malicious release looks exactly like a routine one.

[ClawSecure @ClawSecure]

A new user scan just came through ClawSecure for xeno_final. Score: 90/100, Safe, 2 findings.

[ClawSecure @ClawSecure]

A new user scan just came through ClawSecure for Hello-World by octocat, and it came back clean: 95/100, Safe. One medium finding worth a look, nothing that changes the verdict.

[ClawSecure @ClawSecure]

awesome-copilot by github came through ClawSecure in a new user scan. Score: 95/100, Safe, 1 finding.

[ClawSecure @ClawSecure]

A new user scan just came through ClawSecure for agents by wshobson. Score: 95/100, Safe, 1 finding.