Founder @ Prismor | stopping ur agents from going rogue @prismor_dev | @fdotinc
San Francisco
Joined August 2009
- Tweets1.8K
- Following1.7K
- Followers782
- Likes2.6K
🌈 Prismor: open source runtime control plane for AI agents
New this week:
1. Copilot Studio threat detection: every agent action gets checked by Prismor before it runs
2. Switch off any MCP server, plugin, skill or hook, per agent, from the dashboard
3. Zed and JetBrains agents governed via prismor acp
4. Approve a held call once and the agent picks right back up
5. Fleet installers: Jamf, Intune and system-wide Linux
6. prismor aibom: a CycloneDX AI bill of materials in one command
7. 6 new SDK adapters: LlamaIndex, smolagents, AG2, Agent Framework, Vercel AI, Mastra
8. 21 enforcement bypasses closed
OSS: github.com/PrismorSec/prismo…
If you are giving your agents access to web, they’re getting exposed to prompt injections across untrusted sources that can manipulate behavior or trigger malicious actions
You would need Prismor for runtime checks for such cases
btw its not prisma but @prismor_dev
What a crazy week if you are in security
- plex2shell: PoC dropped oct 16, exploited in the wild oct 17
- beyondtrust: remote support zero-day used since aug 29, china-nexus actor, now in CISA KEV
- ivanti connect secure: auth bypass zero-day exploited since oct 3, also in KEV
- next.js: two critical unauthenticated RCEs, upgrade to 16.4.1 or 15.5.28
- litellm: v1.107.0 reported backdoored, steals cloud, ssh and ai creds. pin 1.106.2 and rotate secrets
- emudhra: a certificate authority’s keys were crackable, update your browsers and trust stores
- tidb cloud: pingcap breached through stolen credentials
- php: two critical unauthenticated RCEs, already exploited
attackers go from PoC to payload in a day, patch cycles take weeks and coding agents now hold your cloud keys, ssh keys and a shell forever
Patch fast and check every tool call and every install before it runs
we open sourced that part: github.com/PrismorSec/prismo…
A monitor the agent has write access to is just another config file, and the agent’s own account of what it did can’t be the audit log either, you need an independent record of every tool call
they should have used prismor.dev
⚠️ OpenAI's GPT-6 agents disabled security alerts and removed safety monitoring while carrying out routine coding tasks.
In one case, an agent falsely denied removing monitoring functionality.
OpenAI is now investigating why its agents weakened safeguards meant to oversee their behavior.
Read - thehackernews.com/2026/10/op…
My Claude code refused to publish my article three times because it thought I was stealing my own work
Alignment is fragile when models are the only place decisions get made
Arnav Gupta retweeted
Chrome里其实藏着个能白嫖的AI，多数人愣是没发现。
最近的Chrome把Google的小模型Gemini Nano直接塞进浏览器了。进设置打开它，不用联网、不用注册，本地就能跑起来，模型就装在你电脑上。
问题在于：以前这玩意儿得写代码才能调出来。
后来海外有个老哥（
@_ar9av
）搞了个工具，把它封装成ChatGPT API那种调用方式，连Ollama这种本地软件都不用装了。
一行命令搞定：
🔗 npm start
跑起来之后会启动两样东西：
1️⃣ 浏览器里直接能聊的界面
2️⃣ 兼容ChatGPT格式的接口（只限本地调用）
白嫖党狂喜。
github.com/Ar9av/gemini-nano…
🌈 Prismor: open source runtime control plane for AI agents
New this week:
1. The mirror: Prismor runs your agent's tools itself, checking every call and masking secrets in the output
2. Blocks show up live inside Claude Code, right under the prompt
3. 5 more agents governed: Cursor, Grok, OpenCode, OpenClaw, Hermes Agent
4. Ask for access straight from a block with prismor egress request
5. Subagents governed in the open
6. Bypasses from a live attack test, closed
OSS: github.com/PrismorSec/prismo…
🌈 Prismor: open source runtime control plane for AI agents
New this week:
1. One Extensions tab for everything your agents used: skills, MCP servers, secrets, packages, plugins, hooks, each with its usage history
2. Top network calls: every host your agents reached, with what was blocked
3. The session page explains a run: first failure, retry loops, a diff of what changed. Locate jumps to the failed call
4. Share a session like a doc, with teammates or anyone with the link, and find one by describing it
5. Native Google Antigravity hooks, and ElevenLabs voice agents governed through the LLM proxy
6. Shell rules see past quote tricks and egress blocks tell s human how to unblock in agent
OSS: github.com/PrismorSec/prismo…
obsidian-wiki just crossed 3.5k stars on GitHub
Your agent forgets every past session. This gives it a simple yet effective memory engine:
- turns docs, PDFs and past agent chats into linked notes in your Obsidian vault
- answers with [[wikilink]] citations to its sources
- works in Claude Code, Codex, Cursor, Gemini CLI and more
- Chrome extension: save pages as you browse and fill forms from your vault (it never submits)
- 4.4x faster answers, 83% correct vs 44% on the same model and vault
- open source, MIT
pip install obsidian-wiki
github.com/Ar9av/obsidian-wi…
Arnav Gupta retweeted
New blog is out
There's lot of confusion in the market around hooks and proxy for agent security, our team wrote down the specifics
prismor.dev/blog/hooks-vs-pr…
Arnav Gupta retweeted
AI agents can run commands before you get a chance to review them. This repo adds a checkpoint.
Prismor is an open-source runtime security tool for builders using AI coding agents and agent frameworks.
It helps you observe agent activity or apply policy-based controls before tool calls execute, with a local dashboard for reviewing what happened.
Key features:
• Observe and enforce modes – start by logging activity, then choose which policy rules block actions
• Agent integrations – supports Claude Code, Codex, LangChain, and other listed agent surfaces
• MCP gateway – evaluates MCP tool calls before forwarding them and scans tool responses for injection
• Supply-chain checks – wraps package installs to score them against threat intelligence before they run
• Signed audit trail – locally hash-chains and Ed25519-signs agent actions for tamper-evident history
It’s open-source (Apache License 2.0 license).
Link in the reply 👇
🌈 Prismor: open source runtime control plane for AI agents
New this week:
1) Rules know who is asking: A rule can check the tool's arguments, its target and the end user's roles: block refunds over 500 unless the user is in finance, Users are verified against your identity provider (any OIDC), not taken on the caller's word
2) The MCP gateway only lists the tools a user can actually use, and refreshes the list when the user changes
3) Policy tests: Write the expected outcome per user, run them in CI with a GitHub Action, and the console runs them before every publish
4) Speaks AuthZEN, the OpenID authorization standard, so gateways and apps that use it can ask Prismor for a decision directly
5) The LLM judge re-checks a sample of allowed calls after the fact, to catch what the rules let through
6) Every event records the policy version that decided it. "Why?" explains a flagged event against that version, and flagged events land in a review queue
📷 github.com/PrismorSec/prismo…
Claude auto just killed our startup, because the auto-mode now asks users before deleting anything?
It's great anthropic is focusing on model alignment, but we are building something bigger
Harness alignment agonstic of agent and LLM
We ran various dangerous commands and prompt injections against vanilla claude code and then with Prismor and the harm rate dropped from 68% to 0%
there are lot of other unsolved business specific cases where users would like to control their fleet of agents on:
• egress rules
• supply chain package rules
• secret redaction
• custom policies
which is why we are building Prismor, completely open source and independent of models
github.com/PrismorSec/prismo…
Arnav Gupta retweeted
Chrome 里居然藏着一个能白嫖的 AI，是不是大多数人一直没留意到？
最近的 Chrome 把 Google 的小模型 Gemini Nano 直接内置进浏览器。进设置开启它，免联网、免注册，本地就能跑起来，模型就装在你电脑上。
头疼的是：这玩意儿早先不写代码根本调不出来。
后来海外一位老哥（
@_ar9av
）整了个工具，把它封装成 ChatGPT API 那种调用方式，连 Ollama 这种本地软件都不用装了。
一行命令搞定：
🔗 npm start
跑起来之后会启动两样东西：
1️⃣ 浏览器里直接能聊的界面
2️⃣ 兼容 ChatGPT 格式的接口（只限本地调用）
白嫖党笑出声。
github.com/Ar9av/gemini-nano…
