Aguara v0.22.1 is out.
This is a focused incident-response patch for the Red Hat / Miasma npm compromise reported on 2026-06-01.
The issue: compromised npm packages can execute during install, inside the developer or CI environment, before the application ever runs in production.
That environment often has access to what attackers actually want: CI tokens, trusted publishing credentials, cloud credentials, kubeconfig, SSH/GPG keys, Docker credentials, Vault tokens, .env files, and package manager tokens.
Aguara now detects the affected redhat-cloud-services/* packages offline, by exact package and version.
It can find them in installed dependencies and in common npm lockfiles, so teams can check a repo before running install and also validate already-materialized environments.
No package execution. No registry lookup during the scan.
https://t.co/8AS2N1kDkG
AI agents are moving into real company workflows.
They write code, call tools, load MCP servers, run commands, use authenticated CLIs, install packages and connect to internal systems, workflows and data.
That changes the security problem.
Companies do not only need to know whether a model is safe. They need to know what the agent can access, what rules apply to its work and what evidence exists after the work is done.
That is what we are building at Oktsec.
Access.
Policy.
Evidence.
A local-first cybersecurity layer for AI agents.
The open source product gives developers local control from day one. Oktsec Enterprise extends that into a control and evidence layer for teams and companies adopting agents in real environments.
No LLM in the critical security path.
No cloud dependency by default.
Reviewable by design.
AI-agent work needs to become governable before it becomes invisible infrastructure.
Aguara keeps moving.
These last releases were less about adding noise and more about making the tool practical for real teams: easier to adopt in CI, safer when using fresh intel, and better at checking dependencies before they run.
Highlights:
- teams can now baseline existing scan results and fail only on new risk
fresh advisory data is signed and verified before Aguara trusts it
- npm projects get stronger pre-install coverage across package-lock, pnpm and Yarn classic
- Python and Rust package checks now bind suspicious behavior more precisely
- the embedded advisory snapshot is smaller and easier to maintain
Coming next:
- clearer freshness signals for local intel
- deeper JavaScript analyzer work
- more coverage for agent and supply-chain workflows
Aguara is open source.
https://t.co/8AS2N1k5v8
Bounty hunting is 20% coding, 80% overhead. The fix is usually trivial. The real time sink is understanding the codebase, navigating someone else’s tech debt, setting up the environment, dealing with contribution rules, formatting the PR and handling access restrictions.
litellm was compromised on PyPI. 97 million monthly downloads.
.pth file executes on every Python startup. Exfiltrates SSH keys, cloud creds, K8s secrets. Encrypts with RSA. Creates privileged pods across your cluster. Installs systemd persistence.
MCP clients like Cursor auto-download deps via uvx without version pins. That's how the discoverer got hit.
Find out if you're compromised in 60 seconds with Aguara:
brew install garagon/tap/aguara
aguara check
aguara clean
Scans Python environments + uv/pip/npx caches. Shows what it found, asks confirmation, quarantines for forensics.
Prevent on MCP servers:
aguara scan /path/to/server/ --severity high
https://t.co/1bUW81qkxl
You have MCP servers running. Claude Desktop, Cursor, VS Code, maybe a custom one. Every tool call your agent makes goes straight to the server. No scanning, no access control, no logs.
Here is how to put a security layer in front of all of them.
https://t.co/SFzQ2Q7ju1
Oktsec already integrates with OpenClaw. 230 detection rules scan every tool call before execution, per-agent tool policies control what each claw can access, and a tamper-evident audit trail logs everything. Works with NemoClaw via Docker Sandbox network proxy.
🦞 Ready to deploy @OpenClaw? Our just released NVIDIA NemoClaw simplifies running OpenClaw always-on assistants more safely with a single command.
✅ Deploy claws more safely
✅ Run any coding agent
✅ Deploy anywhere
Try with a free NVIDIA Brev Launchable: 🔗 https://t.co/ofWZzuVsU2
Here's how you build software in 2026: Someone says something. You open a Conductor session in plan mode. You paste what they said. You go. https://t.co/GaiZyytTuH
@garrytan Thanks @garrytan! Applied for the YC Summer 2026 batch, building @oktsec around agent security. Hoping to talk more about where this is all heading. https://t.co/RsXZ9TLIiI
272,000 attacks against 13 frontier AI models. Every one broken. Gray Swan AI ran this with @OpenAI, @AnthropicAI, @Meta, and @NIST.
The part that matters: attacks only counted if the agent executed the harmful action AND hid it from the user. Clean response, no alert, damage already done.
5 universal attack templates transfer across 9 models. This is not a model bug. It is structural.
The paper's conclusion: "system-level and architectural defenses beyond model-level robustness training alone."
https://t.co/68pNm3kSzp
Only 21.9% of orgs treat AI agents as identities. The rest use shared API keys. Here's the five-layer identity stack agents actually need. - https://t.co/AdOlctXwXC #aiagentsecurity#aiagents
Oktsec v0.10.0 is out. Delegation chains, LLM escalation, scan profiles, ephemeral keys, CLI hooks. From 85 rules to 188. From MCP-only to full AI agent visibility. https://t.co/ay8141dhw0
Gambit Security published a case where an attacker used Claude (Anthropic's model) against Mexican government infrastructure. The prompts were all in Spanish, directing the model to do recon, find weaknesses, and write exfil scripts.
The attacker basically used an LLM as a junior pentester. Find the vuln, write the exploit, automate the data grab. The barrier to pulling off something like this has collapsed.
Real question for AI companies: are the guardrails actually working? Because this attacker apparently got enough output to compromise government systems. That should bother everyone building these models.
Governments that haven't war-gamed AI-assisted attacks against their infrastructure are behind. Red teams need AI-offensive scenarios in their playbooks now, not next quarter.
Threat actors contact employees directly through Microsoft Teams. They pretend to be IT support or a vendor. Target sectors are finance and healthcare.
The play is simple. Talk the victim into opening Quick Assist (built into Windows, Microsoft-signed) to "fix an issue." Once in, they deploy A0Backdoor. Full C2. Persistence, data theft, lateral movement. And because Quick Assist is a legit signed binary, a lot of security tools just wave it through.
Fix: restrict Quick Assist via GPO. Lock down external access in Teams. Train your people (yes, again) that IT will never cold-call them on Teams asking for remote access. Monitor for unexpected remote assistance tool execution.