Skip to main content

Security

Three things we would rather you heard from us first.

AgentShield never executes anything​

The agent's hook asks "may I?", AgentShield answers, and the agent's own runtime runs the action or doesn't. There is no daemon in the data path for shell commands, and the CLI has no subcommand that spawns a process from user input. A build-time test enforces this: any change that adds process execution to the evaluator fails CI.

Evaluation is local and telemetry is off​

Decisions are made on the machine with no model calls and no network calls. A standalone install sends nothing anywhere. When an installation is connected to an organisation it sends heartbeats and audit events; commands are redacted in the dashboard by default and the raw record stays in the secured audit log.

It will not catch everything​

AgentShield is deterministic analysis, not magic. Novel obfuscation can get past pattern and structural analysis, which is why the pipeline also has heuristic layers, why the default for the unknowable is AUDIT rather than a silent ALLOW, and why we publish our own bypasses and the layer we add for each. Read It took three lines of bash to beat six layers.

Platform​

  • Sign-in supports TOTP two-factor authentication with recovery codes.
  • Audit events are hash-chained and the chain is verified on evidence export.
  • Rule packs and taxonomy artifacts are versioned and pinned; see Verifying artifact hashes.
  • Managed installations can refuse to be disabled; every attempt is logged.

Reporting a vulnerability​

Write to [email protected]. We would rather hear about a bypass from you than read about it later, and we credit reporters in the fix.