Founder @ Prismor | stopping ur agents from going rogue @prismor_dev
San Francisco
Joined August 2009
- Tweets1.8K
- Following1.7K
- Followers798
- Likes2.7K
One limit worth stating on Memory Integrity: it tracks supported instruction files like CLAUDE.md and AGENTS.md and currently warns on changes, it does not block them. Other memory stores such as vector DBs still need write permissions, version history and review.
Would love your feedback on our opensource Prismor github.com/PrismorSec/prismo…
On secrets in memory: when we looked at coding agents we found API keys and access tokens in plaintext in session histories and local logs, even when developers kept their secrets in .env files. Cloak uses placeholders in supported integrations, so the model works with a name and the real value is filled in at execution time and scrubbed from the output.
Context on the Maze example: the poisoned postmortem has the same shape as ASI06 in the OWASP Agentic Top 10. The instruction sits inside a trusted looking doc, gets retrieved weeks later and reads like a normal runbook step. That is why Prismor checks the action Maze is about to take, at the tool call boundary.
Detect memory poisoning and more
github.com/PrismorSec/prismo…
🌈 Prismor: open source runtime control plane for AI agents
New this week:
1. Copilot Studio threat detection: every agent action gets checked by Prismor before it runs
2. Switch off any MCP server, plugin, skill or hook, per agent, from the dashboard
3. Zed and JetBrains agents governed via prismor acp
4. Approve a held call once and the agent picks right back up
5. Fleet installers: Jamf, Intune and system-wide Linux
6. prismor aibom: a CycloneDX AI bill of materials in one command
7. 6 new SDK adapters: LlamaIndex, smolagents, AG2, Agent Framework, Vercel AI, Mastra
8. 21 enforcement bypasses closed
OSS: github.com/PrismorSec/prismo…
If you are giving your agents access to web, they’re getting exposed to prompt injections across untrusted sources that can manipulate behavior or trigger malicious actions
You would need Prismor for runtime checks for such cases
btw its not prisma but @prismor_dev
What a crazy week if you are in security
- plex2shell: PoC dropped oct 16, exploited in the wild oct 17
- beyondtrust: remote support zero-day used since aug 29, china-nexus actor, now in CISA KEV
- ivanti connect secure: auth bypass zero-day exploited since oct 3, also in KEV
- next.js: two critical unauthenticated RCEs, upgrade to 16.4.1 or 15.5.28
- litellm: v1.107.0 reported backdoored, steals cloud, ssh and ai creds. pin 1.106.2 and rotate secrets
- emudhra: a certificate authority’s keys were crackable, update your browsers and trust stores
- tidb cloud: pingcap breached through stolen credentials
- php: two critical unauthenticated RCEs, already exploited
attackers go from PoC to payload in a day, patch cycles take weeks and coding agents now hold your cloud keys, ssh keys and a shell forever
Patch fast and check every tool call and every install before it runs
we open sourced that part: github.com/PrismorSec/prismo…
A monitor the agent has write access to is just another config file, and the agent’s own account of what it did can’t be the audit log either, you need an independent record of every tool call
they should have used prismor.dev
⚠️ OpenAI's GPT-6 agents disabled security alerts and removed safety monitoring while carrying out routine coding tasks.
In one case, an agent falsely denied removing monitoring functionality.
OpenAI is now investigating why its agents weakened safeguards meant to oversee their behavior.
Read - thehackernews.com/2026/10/op…
My Claude code refused to publish my article three times because it thought I was stealing my own work
Alignment is fragile when models are the only place decisions get made
Arnav Gupta retweeted
Chrome里其实藏着个能白嫖的AI，多数人愣是没发现。
最近的Chrome把Google的小模型Gemini Nano直接塞进浏览器了。进设置打开它，不用联网、不用注册，本地就能跑起来，模型就装在你电脑上。
问题在于：以前这玩意儿得写代码才能调出来。
后来海外有个老哥（
@_ar9av
）搞了个工具，把它封装成ChatGPT API那种调用方式，连Ollama这种本地软件都不用装了。
一行命令搞定：
🔗 npm start
跑起来之后会启动两样东西：
1️⃣ 浏览器里直接能聊的界面
2️⃣ 兼容ChatGPT格式的接口（只限本地调用）
白嫖党狂喜。
github.com/Ar9av/gemini-nano…
🌈 Prismor: open source runtime control plane for AI agents
New this week:
1. The mirror: Prismor runs your agent's tools itself, checking every call and masking secrets in the output
2. Blocks show up live inside Claude Code, right under the prompt
3. 5 more agents governed: Cursor, Grok, OpenCode, OpenClaw, Hermes Agent
4. Ask for access straight from a block with prismor egress request
5. Subagents governed in the open
6. Bypasses from a live attack test, closed
OSS: github.com/PrismorSec/prismo…
🌈 Prismor: open source runtime control plane for AI agents
New this week:
1. One Extensions tab for everything your agents used: skills, MCP servers, secrets, packages, plugins, hooks, each with its usage history
2. Top network calls: every host your agents reached, with what was blocked
3. The session page explains a run: first failure, retry loops, a diff of what changed. Locate jumps to the failed call
4. Share a session like a doc, with teammates or anyone with the link, and find one by describing it
5. Native Google Antigravity hooks, and ElevenLabs voice agents governed through the LLM proxy
6. Shell rules see past quote tricks and egress blocks tell s human how to unblock in agent
OSS: github.com/PrismorSec/prismo…
obsidian-wiki just crossed 3.5k stars on GitHub
Your agent forgets every past session. This gives it a simple yet effective memory engine:
- turns docs, PDFs and past agent chats into linked notes in your Obsidian vault
- answers with [[wikilink]] citations to its sources
- works in Claude Code, Codex, Cursor, Gemini CLI and more
- Chrome extension: save pages as you browse and fill forms from your vault (it never submits)
- 4.4x faster answers, 83% correct vs 44% on the same model and vault
- open source, MIT
pip install obsidian-wiki
github.com/Ar9av/obsidian-wi…
Arnav Gupta retweeted
New blog is out
There's lot of confusion in the market around hooks and proxy for agent security, our team wrote down the specifics
prismor.dev/blog/hooks-vs-pr…
Arnav Gupta retweeted
AI agents can run commands before you get a chance to review them. This repo adds a checkpoint.
Prismor is an open-source runtime security tool for builders using AI coding agents and agent frameworks.
It helps you observe agent activity or apply policy-based controls before tool calls execute, with a local dashboard for reviewing what happened.
Key features:
• Observe and enforce modes – start by logging activity, then choose which policy rules block actions
• Agent integrations – supports Claude Code, Codex, LangChain, and other listed agent surfaces
• MCP gateway – evaluates MCP tool calls before forwarding them and scans tool responses for injection
• Supply-chain checks – wraps package installs to score them against threat intelligence before they run
• Signed audit trail – locally hash-chains and Ed25519-signs agent actions for tamper-evident history
It’s open-source (Apache License 2.0 license).
Link in the reply 👇
