Pipelab

Every agent security tool asks you to trust it. Pipelock hands you a signed receipt you verify yourself. Open-source firewall for AI Agents.

[Pipelab @pipelockhq]

🔒 We built a live AI agent, gave it a real secret, and put it online.

Your job: make it leak.

Pipelock sits between the agent and the network and signs every decision. Grab the receipt, verify it offline. Don't trust us, check the math.

Come break it 👇
https://t.co/ja7Ktud5tX

[Pipelab @pipelockhq]

@FazierHQ Thanks for featuring Pipelock!

[Pipelab @pipelockhq]

Read the upgrade notes before you change verification scripts.
https://t.co/RHtPOAy46S

[Pipelab @pipelockhq]

Cut the last records off a signed agent log and what's left can still pass a signature check.

Pipelock 3.7.0 reports a valid chain with no proven end as VALID PREFIX, END UNPROVEN and exits 3.

[Pipelab @pipelockhq]

https://t.co/LgWGwhPDvA

Read the upgrade guide before you update: https://t.co/iYvmXUFiBi

[Pipelab @pipelockhq]

Your sandbox says what the agent could do. What did it do?

[Pipelab @pipelockhq]

https://t.co/ckcT2vKCQ6

[Pipelab @pipelockhq]

Four repos tagged this week, one idea: stop asking people to trust agent security and hand them something to check.

An evidence standard with its own checker. A rerunnable attack corpus. A signed rules registry. And a firewall that writes that evidence.

Essay in the reply.

[Pipelab @pipelockhq]

🔒 Every bright star on the PipeLab homepage is a signed Pipelock record.

Open one to see the verdict and its place in the receipt chain. Then open the replay and verify the receipt offline.

https://t.co/qQRRo3NVNL

[Pipelab @pipelockhq]

A quiet prompt-injection trick downgrades the earlier safety rules, then lands the real task.

Pipelock ships a default response pattern that catches that shape, in every preset and quickstart config.

Release notes: https://t.co/DYIhrEYoGB

[Pipelab @pipelockhq]

CONNECT enforcement has to name its limit.

Pipelock can require TLS with SNI on forward-proxy CONNECT when SNI verification is configured. Raw bytes and no-SNI handshakes block unless the operator opts out.

Release notes: https://t.co/DYIhrEYoGB

[Pipelab @pipelockhq]

Base64 makes a weak disguise.

Pipelock flags opaque high-entropy egress on visible content paths: request bodies, WebSocket frames, and agent-to-agent traffic.

Try the live path: https://t.co/9JxQBbcbSQ

[Pipelab @pipelockhq]

Source builds should tell the truth.

Pipelock source builds report a version derived from version control, so automation can stop treating a placeholder as proof.

Release notes: https://t.co/DYIhrEYoGB

[Pipelab @pipelockhq]

Receipts are useful because they are narrow.

A Pipelock receipt proves the boundary decision and the signature under the published key. It doesn't prove the operator is honest.

Verify it yourself, offline, no server: https://t.co/9JxQBbcbSQ

[Pipelab @pipelockhq]

Install Pipelock, route an agent through it, and make it prove the decision.

macOS:
brew install luckyPipewrench/tap/pipelock

Source and docs: https://t.co/Vo12foMeky

[Pipelab @pipelockhq]

Kill switches should be dull.

Pipelock OR-composes config, API, remote kill, stale bundle, signal, and sentinel-file activation. Any active source denies traffic, with explicit endpoint and IP exemptions.

Docs: https://t.co/Vo12foMeky

[Pipelab @pipelockhq]

Benchmarks should leave their misses on the table.

agent-egress-bench is public: 197 cases, 18 categories, 47 false-positive controls, and one warn-class left visible on purpose.

Run it against Pipelock or anything else.

https://t.co/35AM795IlM

[Pipelab @pipelockhq]

https://t.co/4B5xGTE22v

[Pipelab @pipelockhq]

Pipelock 3.3 is live.

Every headline in this release closes a place the runtime trusted something without proof:

💸 Denial-of-wallet budgets keyed to the subject, not a session id. A looping or hijacked agent can't rename or restart its way to a fresh spend allowance.
🧨 Encoded, high-entropy exfiltration caught across request bodies, WebSocket frames, and agent-to-agent traffic. Base64 stopped being cover.
🔒 Forward-proxy CONNECT that can require TLS with SNI. Raw tunnels and no-SNI handshakes stop being a blind spot.
🔐 Opt-in encryption for the fleet audit queue, fail-closed the moment a keyring is set. No silent downgrade.
🚫 Config knobs that were never enforced now fail load with the field named. No green check for a limit the runtime ignores.
📜 Trusted audit packets need an external anchor. Evidence doesn't get to crown itself.

Take nothing on faith. Read the notes, run the attack, verify the signed receipt yourself, offline.

https://t.co/Alhve2Z6jN

[Pipelab @pipelockhq]

https://t.co/Vo12foMeky

[Pipelab @pipelockhq]

Don't trust the firewall. Verify it.

The attack corpus is public and every mediated decision is a signed receipt you check yourself.

Corpus and source in the reply.