Oktsec

Cybersecurity for AI agents. Local control, deterministic rules and reviewable evidence for agentic systems. Open source and Enterprise.

[Gus @gus_aragon]

Aguara v0.22.1 is out.

This is a focused incident-response patch for the Red Hat / Miasma npm compromise reported on 2026-06-01.

The issue: compromised npm packages can execute during install, inside the developer or CI environment, before the application ever runs in production.

That environment often has access to what attackers actually want: CI tokens, trusted publishing credentials, cloud credentials, kubeconfig, SSH/GPG keys, Docker credentials, Vault tokens, .env files, and package manager tokens.

Aguara now detects the affected redhat-cloud-services/* packages offline, by exact package and version.

It can find them in installed dependencies and in common npm lockfiles, so teams can check a repo before running install and also validate already-materialized environments.

No package execution. No registry lookup during the scan.

https://t.co/8AS2N1kDkG

[Oktsec @oktsec]

AI agents are moving into real company workflows.

They write code, call tools, load MCP servers, run commands, use authenticated CLIs, install packages and connect to internal systems, workflows and data.

That changes the security problem.

Companies do not only need to know whether a model is safe. They need to know what the agent can access, what rules apply to its work and what evidence exists after the work is done.

That is what we are building at Oktsec.

Access.
Policy.
Evidence.

A local-first cybersecurity layer for AI agents.

The open source product gives developers local control from day one. Oktsec Enterprise extends that into a control and evidence layer for teams and companies adopting agents in real environments.

No LLM in the critical security path.
No cloud dependency by default.
Reviewable by design.

AI-agent work needs to become governable before it becomes invisible infrastructure.

[Gus @gus_aragon]

Aguara keeps moving.

These last releases were less about adding noise and more about making the tool practical for real teams: easier to adopt in CI, safer when using fresh intel, and better at checking dependencies before they run.

Highlights:

- teams can now baseline existing scan results and fail only on new risk
fresh advisory data is signed and verified before Aguara trusts it
- npm projects get stronger pre-install coverage across package-lock, pnpm and Yarn classic
- Python and Rust package checks now bind suspicious behavior more precisely
- the embedded advisory snapshot is smaller and easier to maintain

Coming next:
- clearer freshness signals for local intel
- deeper JavaScript analyzer work
- more coverage for agent and supply-chain workflows

Aguara is open source.

https://t.co/8AS2N1k5v8

[Oktsec @oktsec]

Aguara. Security scanner for AI agents and software supply chains. Detects prompt injection, MCP risks, tool poisoning, unsafe GitHub Actions, secret exfiltration, and compromised packages across npm, pnpm, PyPI, Go, Rust, PHP, Ruby, Java, and .NET. Local-first, no SaaS or LLM calls. https://t.co/mGQfN5tdnA

[Oktsec @oktsec]

Aguara v0.18.2: Security for AI Agents and Supply Chain

[Gus @gus_aragon]

https://t.co/6GhAiGOlb6

[Gus @gus_aragon]

Bounty hunting is 20% coding, 80% overhead. The fix is usually trivial. The real time sink is understanding the codebase, navigating someone else’s tech debt, setting up the environment, dealing with contribution rules, formatting the PR and handling access restrictions.

[Gus @gus_aragon]

Cybersecurity is the new black

[Gus @gus_aragon]

https://t.co/bz1NocnOhk

[Gus @gus_aragon]

litellm was compromised on PyPI. 97 million monthly downloads.

.pth file executes on every Python startup. Exfiltrates SSH keys, cloud creds, K8s secrets. Encrypts with RSA. Creates privileged pods across your cluster. Installs systemd persistence.

MCP clients like Cursor auto-download deps via uvx without version pins. That's how the discoverer got hit.

Find out if you're compromised in 60 seconds with Aguara:

brew install garagon/tap/aguara
aguara check
aguara clean

Scans Python environments + uv/pip/npx caches. Shows what it found, asks confirmation, quarantines for forensics.

Prevent on MCP servers:
aguara scan /path/to/server/ --severity high

https://t.co/1bUW81qkxl

[Oktsec @oktsec]

You have MCP servers running. Claude Desktop, Cursor, VS Code, maybe a custom one. Every tool call your agent makes goes straight to the server. No scanning, no access control, no logs.

Here is how to put a security layer in front of all of them.

https://t.co/SFzQ2Q7ju1

[Oktsec @oktsec]

Oktsec already integrates with OpenClaw. 230 detection rules scan every tool call before execution, per-agent tool policies control what each claw can access, and a tamper-evident audit trail logs everything. Works with NemoClaw via Docker Sandbox network proxy.

[NVIDIA AI Developer @NVIDIAAIDev]

🦞 Ready to deploy @OpenClaw? Our just released NVIDIA NemoClaw simplifies running OpenClaw always-on assistants more safely with a single command.

✅ Deploy claws more safely
✅ Run any coding agent
✅ Deploy anywhere

Try with a free NVIDIA Brev Launchable: 🔗 https://t.co/ofWZzuVsU2

[Garry Tan @garrytan]

Here's how you build software in 2026: Someone says something. You open a Conductor session in plan mode. You paste what they said. You go. https://t.co/GaiZyytTuH

[Gus @gus_aragon]

@garrytan Thanks @garrytan! Applied for the YC Summer 2026 batch, building @oktsec around agent security. Hoping to talk more about where this is all heading. https://t.co/RsXZ9TLIiI

[Garry Tan @garrytan]

Thanks Gus

[Oktsec @oktsec]

272,000 attacks against 13 frontier AI models. Every one broken. Gray Swan AI ran this with @OpenAI, @AnthropicAI, @Meta, and @NIST.

The part that matters: attacks only counted if the agent executed the harmful action AND hid it from the user. Clean response, no alert, damage already done.

5 universal attack templates transfer across 9 models. This is not a model bug. It is structural.

The paper's conclusion: "system-level and architectural defenses beyond model-level robustness training alone."
https://t.co/68pNm3kSzp

[Gus @gus_aragon]

POV: sos un agente de AI intentando ejecutar un Bash sin autorización y la langosta de @oktsec te está esperando🦞

[HackerNoon | Learn Any Technology @hackernoon]

Only 21.9% of orgs treat AI agents as identities. The rest use shared API keys. Here's the five-layer identity stack agents actually need. - https://t.co/AdOlctXwXC #aiagentsecurity #aiagents

[Oktsec @oktsec]

Oktsec v0.10.0 is out. Delegation chains, LLM escalation, scan profiles, ephemeral keys, CLI hooks. From 85 rules to 188. From MCP-only to full AI agent visibility. https://t.co/ay8141dhw0

[Oktsec @oktsec]

Gambit Security published a case where an attacker used Claude (Anthropic's model) against Mexican government infrastructure. The prompts were all in Spanish, directing the model to do recon, find weaknesses, and write exfil scripts.

The attacker basically used an LLM as a junior pentester. Find the vuln, write the exploit, automate the data grab. The barrier to pulling off something like this has collapsed.

Real question for AI companies: are the guardrails actually working? Because this attacker apparently got enough output to compromise government systems. That should bother everyone building these models.

Governments that haven't war-gamed AI-assisted attacks against their infrastructure are behind. Red teams need AI-offensive scenarios in their playbooks now, not next quarter.

[Oktsec @oktsec]

Threat actors contact employees directly through Microsoft Teams. They pretend to be IT support or a vendor. Target sectors are finance and healthcare.

The play is simple. Talk the victim into opening Quick Assist (built into Windows, Microsoft-signed) to "fix an issue." Once in, they deploy A0Backdoor. Full C2. Persistence, data theft, lateral movement. And because Quick Assist is a legit signed binary, a lot of security tools just wave it through.

Fix: restrict Quick Assist via GPO. Lock down external access in Teams. Train your people (yes, again) that IT will never cold-call them on Teams asking for remote access. Monitor for unexpected remote assistance tool execution.