AI Agent Security Blog: Research, CVE Analysis, Runtime Defense on PipeLab

Your sandbox says what the agent could do. What did it do?

Fri, 02 Oct 2026 00:00:00 +0000

Agent sandboxes describe the boundary before the run. The question after it is what the agent changed on disk. And an empty change list is only evidence if the tool can also say when it didn’t look.

Pipelock v3.6: Contained Agents You Can Watch and Check

Fri, 02 Oct 2026 00:00:00 +0000

Pipelock v3.6 gives each contained agent its own network namespace, lets you watch or take over its screen, attempts to sign a record of which workspace files changed, lets keys reach the services that issued them, and gives each process its own receipt chain.

A secret scanner that blocks git push gets turned off

Fri, 02 Oct 2026 00:00:00 +0000

Blocking every GitHub token everywhere breaks the most ordinary thing an agent does, so operators exempt the whole host or switch the rule off. The better question is where the credential is going, and the providers already publish the answer.

Agent Egress Base Rates: Most Alerts Can Still Be Wrong

Mon, 07 Sep 2026 00:00:00 +0000

A low false-positive rate can still produce mostly false alerts. Work through the counts before treating a benchmark as a production forecast.

Attack Corpus Governance in Agent Egress Bench

Sat, 05 Sep 2026 00:00:00 +0000

A public attack corpus needs fixed cases, visible errors, separate benign scoring, and result ownership that stays with the publisher.

Pipelock v3.5: Native Agent Evidence Level Records

Tue, 01 Sep 2026 00:00:00 +0000

Pipelock v3.5 writes Agent Evidence Level records natively, scans WebSocket control payloads, enforces the containment layers a sandbox launch applied, and disables npm lifecycle scripts in contained installs by default.

Agent Security Asks You to Trust It. Four Things You Can Check Instead

Tue, 01 Sep 2026 00:00:00 +0000

An evidence standard with its own checker, a rerunnable attack corpus, a signed rules registry, and a firewall that writes that evidence natively. Three first releases and a Pipelock release, one idea: hand people the artifact.

What a Hash Chain Can't Prove

Mon, 31 Aug 2026 00:00:00 +0000

Hash-chained audit logs are getting sold as proof of what an AI agent did. Two questions separate a tamper-evident log from evidence: who holds the key, and where the recorder sits.

Pipelock v3.4: A Trust Label Can't Weaken a Block

Thu, 20 Aug 2026 00:00:00 +0000

Pipelock v3.4 stops MCP trust labels from weakening stricter response policy, scans reverse-proxy media request bodies, hardens credential detection across encoding and URL seams, and adds containment-aware upgrades.

We built a test corpus for AI agent egress security tools

Sun, 08 Mar 2026 00:00:00 +0000

Correction (2026-08-02): The corpus has grown to 213 logical cases across 18 categories since this was written. View current corpus details.

72 attack cases across 8 categories. Secret exfiltration, prompt injection, MCP tool poisoning, chain detection. Any security tool can run against it. No vendor lock-in.

I published my benchmark scores. Your turn.

Mon, 06 Apr 2026 00:00:00 +0000

Correction (2026-08-02): The corpus has grown to 213 logical cases across 18 categories since this was written. View current corpus details.

Every score published. Pipelock runs the gauntlet before every release and posts the results for anyone to inspect.

Pipelock v3.1: Operator Evidence Gets Teeth

Mon, 13 Jul 2026 00:00:00 +0000

Correction (2026-08-02): The corpus has grown to 213 logical cases across 18 categories since this was written. View current corpus details.

Pipelock v3.1 turns runtime enforcement into operator evidence: an enterprise dashboard, a free evidence viewer, stricter receipt verification, SIEM/fleet readiness, and a refreshed public Agent Egress Bench corpus.

Pipelock v3.3: The Budget an Agent Can't Reset

Thu, 30 Jul 2026 00:00:00 +0000

Pipelock v3.3 keys spend limits to the subject so a renamed or restarted agent cannot buy a fresh allowance, adds encoded-exfiltration detection across request bodies, WebSocket frames, and agent-to-agent traffic, ships opt-in encryption for the fleet audit queue, and can require TLS with SNI on forward-proxy CONNECT.

Your benign set should look malicious

Fri, 17 Jul 2026 00:00:00 +0000

A detection’s false-positive rate is meaningless if the benign test set never looks like an attack. The negatives that break real rules are the ones that carry attack-shaped content. Here is how to build them.

Pipelock v3.0: Fail Closed by Default

Tue, 23 Jun 2026 00:00:00 +0000

Pipelock v3.0 hardens enforcement defaults to fail closed across the board, anchors self-update to a signed release manifest, and gives the Enterprise Conductor the operations a real fleet needs to run long-term: decommission a follower, and back up and restore the control plane.

Wrapping Claude Code MCP Servers with Pipelock

Tue, 10 Feb 2026 00:00:00 +0000

Claude Code has shell access, API keys, and MCP servers feeding directly into its context window. Here’s what can go wrong and how to lock it down.

Pipelock v2.6: Inspection Moves to the Operation Boundary

Sun, 31 May 2026 00:00:00 +0000

Pipelock v2.6 decides egress by operation, not just by host: allow or deny individual API and GraphQL operations, catch prompt injection hidden in files, bridge hook-based agent events into the scanner pipeline, and harden MCP against the attack chains the NSA guidance calls out.

What Stateless MCP Means for Agent Runtime Security

Sat, 23 May 2026 00:00:00 +0000

MCP 2026-07-28 deletes the session. Here’s what that changes at the runtime layer, and why outside-the-agent mediation matters more under stateless.

What the NSA's MCP security guidance says, and what an agent firewall does

Fri, 22 May 2026 00:00:00 +0000

The NSA’s May 2026 MCP guidance names filtering outgoing proxies, DLP, sandboxing, message integrity, output filtering, and local MCP scans. Here is where an agent firewall fits.

Pipelock v2.5.0: Portable Audit Evidence and Host Containment

Wed, 20 May 2026 00:00:00 +0000

Pipelock v2.5.0 adds Audit Packet verifiers, host containment lifecycle commands, strict federation, MCP integrity manifests, and broader IDE coverage.