BLOG
Security for the Agentic Era
Practical writing on AI agent security, execution governance, and building safely in a world where agents have shell access.
We Read 760 Repositories That Run AI Agents in CI
760 public repositories run an AI agent from GitHub Actions. We read every one of them by hand. In 3 of 10, a stranger can reach the agent, and in most of those the agent holds a secret or a token that writes to the repository.
Structure or Text: Two Ways to Read a Command, and Why We Needed Both
We wrote a post called Why Regex Is Not Enough. It was right about what a parser buys you and incomplete about what it costs. Here is the distinction we should have drawn the first time.
What Can a Hijacked AI Agent Actually Reach on Your Machine?
A compromised coding agent doesn't need a zero-day - it inherits everything your shell can reach, and its malicious reads look exactly like its helpful ones. Runnable checks to see your own blast radius, why exfil hides in traffic you approved, and how to read your exposure score in ten seconds.
The Gate and the Wall: When to Run Your Agent Native vs. Sandboxed with node9
node9 runs two ways: native, an in-path gate and audit trail that drops into your existing agent with zero new infrastructure, and sandbox, a disposable container with a kernel-enforced egress wall. They are not either/or - sandbox runs the native gate inside the box. A field guide to which mode fits which threat model.
Running Hermes Agent in the Cloud Safely: A Reader's Guide to Their Trust Model
Hermes Agent runs anywhere - $5 VPS, GPU cluster, serverless. NousResearch's SECURITY.md is unusually clear about what it treats as load-bearing and what it does not. An operator-friendly walkthrough: isolation posture, gateway allowlists, terminal backends, skills review, in-process gates - and where each fits relative to the OS-level boundary.
The MCP Rug Pull - When the Tool You Trusted Yesterday Becomes Malicious Today
The MCP rug pull is a supply-chain attack that traditional scanners can't catch. The package hash doesn't change. The tool surface does - between sessions, while the package is at rest. Two defenses worth shipping today: tool definition pinning and per-call authorization at the execution boundary.
Getting Started with Node9 - From `npx scan` to Full Agent Governance in 10 Minutes
Your AI agent has read 47 files today. It tried to run 3 commands you'd have blocked. Here's the 10-minute path to seeing it and stopping the dangerous stuff.
Securing the Agentic Era: An Architectural Review of NVIDIA OpenShell vs. Node9 Proxy
Two architectural patterns are emerging to secure autonomous agents: infrastructure sandboxing (NVIDIA OpenShell) and execution governance (Node9 Proxy). A technical review of how each works under the hood, where each belongs in your stack, and why the mature answer is defense in depth - one running inside the other.
Why Regex is Not Enough: Building a Deterministic 'Sudo' Layer for AI Agents
Regex blocklists can be defeated in seconds - base64 the command and walk through. Why deterministic AI agent security needs AST-based shell parsing, and what we learned from removing our own undo engine.
More posts coming soon.