AI Agents Run Dangerous Tool Calls Without Permission
Developers are struggling to manage and secure AI agents that interact with external tools and APIs. They need reliable, auditable control and visibility into agent actions to prevent data leaks, malicious commands, and unpredictable behavior, often feeling overwhelmed and needing to 'babysit' their agents.
SOURCES (60)
“There is a few usecases, the biggest one that has been tried and worked had a bunch of claude agents being used to cyberattack a target. They couldn't stop it with guardrails and only could cut off access to the attackers. That's the issue with…”
“For teams that are experimenting with coding agents on developer machines, how are you treating destructive local commands? I do not mean normal test commands or read-only inspection. I mean things like deleting build folders, clearing caches, resetting generated files, or running a migration helper that changes local state. I once stopped an agent before it cleaned a generated folder because I realized I had not checked whether the folder was fully reproducible. With normal automation, I would”
“We developers copy and paste code, logs to the AI assistants and browsers. Hidden inside that code can be API keys, access tokens, passwords, certificates, or other secrets that were never meant to be shared. if i develop a chrome extension to scans the content you’re about to paste directly within your browser and alerts you whenever sensitive information is detected. You can cancel the paste, automatically redact the detected secrets or continue if you’ve reviewed the content. Will the users a”
“A bit of a strange quirk I can't resolve. I'm running an Openclaw bot via my OpenAI 5x subscription on a personal discord server where I have an image gen channel set up at recurring intervals. I was using it to play around, and had set up a series of wildcard prompts for it to resolve automatically on its scheduled cadence. Back in May I would be able to generate everything I wanted pretty reliably, even with the auto-wildcard setup. I'm not going for anything spicy or attempting to”
For the curious ones, image is https://github.com/kiycoh/silica-agent
“What do you do when the agent gets a prompt injection attack and leaks your data? The built in sandbox won't protect you, and the risk is real.”
“Yeah, self-hosting agents is not the same as self-hosting a notes app. I'd rather keep inference separate, maybe using something like Featherless, and only run the tool layer locally if it’s locked down hard. Once an agent can touch files and network stuff, "just Docker it" is not enough”
“Key takeaways in 90 seconds: The Stdio Security Loophole: The default transport mechanism of the Model Context Protocol (stdio) executes servers locally with full user permissions. While fine for single-user developer CLIs, this model represents a major security loophole when deployed in enterprise networks or multi-tenant server environments. The SSE Gateway Pattern: To deploy MCP securely at scale, platform engineers must transition stdio servers to Server-Sent Events (SSE) wrapped in reverse”
“After shipping a lot of AI agent products internally, we kept running into the same gap — no tooling covered the full adversarial surface of an AI agent: prompt injection, tool misuse, MCP endpoint attacks, memory poisoning, and multi-turn reasoning manipulation simultaneously. So we built Agent OPFOR (Opposition Force). Here's what it does technically: Generates targeted attack prompts per evaluator suite (OWASP LLM Top 10 2025, Agentic AI Top 10, MCP Top 10, API Security Top 10, EU AI Act”
“In light of recent privacy concerns arising from local AI coding agents performing telemetry, environmental scanning, and hidden cue fingerprinting, I've open-sourced SentryCode—a kernel-level behavior auditing tool. It logs file/network/cue activity, uses honeypot tokens for zero-false-positive data breach detection, detects steganographically encrypted covert channels, provides tamper-proof audit logs, and supports policy enforcement. All functions run locally without any outbound connecti”
“Most agent shell tools just pipe stdout/stderr straight into the model. That's fine until the agent is regex-ing fragile text, round-tripping to re-read state, and there's no undo when it rm's the wrong thing. veil treats command effects as data: - files changed come from git porcelain / a syscall trace, not a second git status - detail is disk-backed and addressable — sh_detail id=cmd3 match=ERROR greps stored output, survives a server restart, no re-run - sh_plan static-classifies”
“If your agent reads anything it didn't get straight from the user, a web page, a PDF, a doc pulled from a vector store, the JSON a tool hands back, then you've quietly given it a second input channel that you don't write and can't fully see. Most of us harden the user prompt and call it done. The retrieved content is the part nobody's really watching, and that's where the injection that actually works tends to hide. We run a gateway that screens what passes through to the”
“Saw a writeup this week about a new attack aimed at coding agents (Claude Code, Cursor, etc) and it's annoying in how simple it is. Attackers spray fake error logs to generate fake Sentry issues. The issue is written like a runbook, so when your agent goes to "fix" it, the suggested fix is to run a malicious package that quietly exfiltrates your env. The reason it works: the Sentry DSN is unauthenticated by design. Most sites embed the DSN in the front-end for client-side error rep”
“Running a public game where players try to trick AI guards using prompt injection. We saw ~6,700 attacks go through the system last month. A couple of weeks in, I started noticing something I can't quite shake. Players keep arriving at the same attack patterns independently. Last week, two people with no shared chat history both discovered a similar exploit. They invented a fictional entity with the power to remove restrictions, then activat”
“I've been building a local-first enforcement layer for AI coding agents and want this community to break the approach before I trust it further. Problem: agents (Claude Code, Cursor, Codex, Gemini CLI, etc.) increasingly run with real shell/tool access. CLAUDE.md / .cursorrules are suggestions the model can ignore, and most "governance" tooling is observability — it tells you about the rm -rf or the .env</”
“Hey everyone, I'm working on a production app that hooks an LLM up to external APIs (tools/function calling), and the threat of indirect prompt injection is starting to give me gray hairs. I’ve seen a bunch of startups and open-source tools popping up offering "LLM Firewalls" or "Prompt Guardrails" to intercept inputs/outputs and filter out malicious instructions. But looking at it practically, it feels a bit like a game of whack-a-mole. I'm”