https://pipelab.org/blog/Security research and practical guides for AI agent security. Attack breakdowns, CVE analysis, runtime defense strategies, agent firewall implementation.Hugoen-USSun, 08 Nov 2026 02:18:07 +0000https://pipelab.org/blog/best-ai-agent-security-tools-2026/https://pipelab.org/blog/best-ai-agent-security-tools-2026/Sun, 12 Apr 2026 00:00:00 +000024 AI agent security options mapped to the six boundaries: model gateway, MCP gateway, identity, platform governance, runtime containment, and network egress.https://pipelab.org/blog/pipelock-v370-release/https://pipelab.org/blog/pipelock-v370-release/Wed, 14 Oct 2026 00:00:00 +0000Parallel signed receipt chains, filesystem grants, verified local MCP services, and an explicit proof that a receipt chain ended.https://pipelab.org/blog/localhost-is-a-place-not-a-program/https://pipelab.org/blog/localhost-is-a-place-not-a-program/Wed, 14 Oct 2026 00:00:00 +0000A local port doesn’t identify the MCP service behind it. Check the connected socket’s owner and program before sending credentials.https://pipelab.org/blog/a-valid-receipt-chain-can-still-be-cut-short/https://pipelab.org/blog/a-valid-receipt-chain-can-still-be-cut-short/Wed, 14 Oct 2026 00:00:00 +0000Every surviving link can verify while the end of a receipt log is missing. Verification needs to say which claim it proved.https://pipelab.org/blog/what-did-the-agent-change/https://pipelab.org/blog/what-did-the-agent-change/Fri, 02 Oct 2026 00:00:00 +0000Agent sandboxes describe the boundary before the run. The question after it is what the agent changed on disk. And an empty change list is only evidence if the tool can also say when it didn’t look.https://pipelab.org/blog/pipelock-v360-release/https://pipelab.org/blog/pipelock-v360-release/Fri, 02 Oct 2026 00:00:00 +0000Pipelock v3.6 gives each contained agent its own network namespace, lets you watch or take over its screen, attempts to sign a record of which workspace files changed, lets keys reach the services that issued them, and gives each process its own receipt chain.https://pipelab.org/blog/credentials-have-an-audience/https://pipelab.org/blog/credentials-have-an-audience/Fri, 02 Oct 2026 00:00:00 +0000Blocking every GitHub token everywhere breaks the most ordinary thing an agent does, so operators exempt the whole host or switch the rule off. The better question is where the credential is going, and the providers already publish the answer.https://pipelab.org/blog/agent-egress-base-rates/https://pipelab.org/blog/agent-egress-base-rates/Mon, 07 Sep 2026 00:00:00 +0000A low false-positive rate can still produce mostly false alerts. Work through the counts before treating a benchmark as a production forecast.https://pipelab.org/blog/attack-corpus-governance/https://pipelab.org/blog/attack-corpus-governance/Sat, 05 Sep 2026 00:00:00 +0000A public attack corpus needs fixed cases, visible errors, separate benign scoring, and result ownership that stays with the publisher.https://pipelab.org/blog/pipelock-v350-release/https://pipelab.org/blog/pipelock-v350-release/Tue, 01 Sep 2026 00:00:00 +0000Pipelock v3.5 writes Agent Evidence Level records natively, scans WebSocket control payloads, enforces the containment layers a sandbox launch applied, and disables npm lifecycle scripts in contained installs by default.https://pipelab.org/blog/check-the-work/https://pipelab.org/blog/check-the-work/Tue, 01 Sep 2026 00:00:00 +0000An evidence standard with its own checker, a rerunnable attack corpus, a signed rules registry, and a firewall that writes that evidence natively. Three first releases and a Pipelock release, one idea: hand people the artifact.https://pipelab.org/blog/what-a-hash-chain-cant-prove/https://pipelab.org/blog/what-a-hash-chain-cant-prove/Mon, 31 Aug 2026 00:00:00 +0000Hash-chained audit logs are getting sold as proof of what an AI agent did. Two questions separate a tamper-evident log from evidence: who holds the key, and where the recorder sits.https://pipelab.org/blog/pipelock-v340-release/https://pipelab.org/blog/pipelock-v340-release/Thu, 20 Aug 2026 00:00:00 +0000Pipelock v3.4 stops MCP trust labels from weakening stricter response policy, scans reverse-proxy media request bodies, hardens credential detection across encoding and URL seams, and adds containment-aware upgrades.https://pipelab.org/blog/agent-egress-bench-benchmark-corpus/https://pipelab.org/blog/agent-egress-bench-benchmark-corpus/Sun, 08 Mar 2026 00:00:00 +0000Correction (2026-08-02): The corpus has grown to 213 logical cases across 18 categories since this was written. View current corpus details.

72 attack cases across 8 categories. Secret exfiltration, prompt injection, MCP tool poisoning, chain detection. Any security tool can run against it. No vendor lock-in.]]>https://pipelab.org/blog/pipelock-gauntlet-public-benchmark/https://pipelab.org/blog/pipelock-gauntlet-public-benchmark/Mon, 06 Apr 2026 00:00:00 +0000Correction (2026-08-02): The corpus has grown to 213 logical cases across 18 categories since this was written. View current corpus details.

Every score published. Pipelock runs the gauntlet before every release and posts the results for anyone to inspect.]]>https://pipelab.org/blog/pipelock-v310-release/https://pipelab.org/blog/pipelock-v310-release/Mon, 13 Jul 2026 00:00:00 +0000Correction (2026-08-02): The corpus has grown to 213 logical cases across 18 categories since this was written. View current corpus details.

Pipelock v3.1 turns runtime enforcement into operator evidence: an enterprise dashboard, a free evidence viewer, stricter receipt verification, SIEM/fleet readiness, and a refreshed public Agent Egress Bench corpus.]]>https://pipelab.org/blog/pipelock-v330-release/https://pipelab.org/blog/pipelock-v330-release/Thu, 30 Jul 2026 00:00:00 +0000Pipelock v3.3 keys spend limits to the subject so a renamed or restarted agent cannot buy a fresh allowance, adds encoded-exfiltration detection across request bodies, WebSocket frames, and agent-to-agent traffic, ships opt-in encryption for the fleet audit queue, and can require TLS with SNI on forward-proxy CONNECT.https://pipelab.org/blog/benign-set-should-look-malicious/https://pipelab.org/blog/benign-set-should-look-malicious/Fri, 17 Jul 2026 00:00:00 +0000A detection’s false-positive rate is meaningless if the benign test set never looks like an attack. The negatives that break real rules are the ones that carry attack-shaped content. Here is how to build them.https://pipelab.org/blog/pipelock-v300-release/https://pipelab.org/blog/pipelock-v300-release/Tue, 23 Jun 2026 00:00:00 +0000Pipelock v3.0 hardens enforcement defaults to fail closed across the board, anchors self-update to a signed release manifest, and gives the Enterprise Conductor the operations a real fleet needs to run long-term: decommission a follower, and back up and restore the control plane.https://pipelab.org/blog/securing-claude-code-with-pipelock/https://pipelab.org/blog/securing-claude-code-with-pipelock/Tue, 10 Feb 2026 00:00:00 +0000Claude Code has shell access, API keys, and MCP servers feeding directly into its context window. Here’s what can go wrong and how to lock it down.