FRESH

Hacker News

Home

I scanned my AI agent framework for destructive/consequential actions, and wow

8 points by Bucko1

by prologic

0 subcomment

This tool doesn't seem to work very well. I tried to run it against my own harness that uses the Anthropic SDK(s) in Go and it turns up nothing. It doesn't seem to understand Go code?

by Bucko1

0 subcomment

I build agent tooling and kept hitting the same thing: tools validate that a request is well-formed, but almost nothing checks that this caller was authorised to do this specific action. So I wrote a scanner for that one shape, a model-controlled parameter reaching a consequential sink (payments, deletion, shell, SQL, egress) with no authorisation check dominating the path.
Then I ran it across 25 pinned repos, 23,476 files, and hand-triaged every finding.
The part I'd most like scrutinised: the first run was 81% precise. 12 of 63 findings were wrong. A Kubernetes rule matched Elasticsearch clients at HIGH severity. A SQL rule caught hardcoded DROP TABLE and missed caller-controlled execute(query), exactly backwards. I've since found and corrected more, including tools guarded by human-in-the-loop primitives I didn't recognise. Every correction is in the study.
What it can't do, stated plainly: guard soundness is undecidable, so it checks that a guard call dominates the path and shares a parameter with the sink — not that the guard is correct. It covers three agent architectures out of seven; custom agent loops are NOT COVERED because that heuristic produced 10 false positives out of 10 candidates and I dropped it rather than ship it.
```
  pipx run actenon-scan scan .
```
Zero runtime dependencies, nothing uploaded, Python and TypeScript. If you can make it report clean on something that obviously isn't, I'd genuinely like the case — the benchmark has a soundness suite specifically for that and it's the part I trust least.