AgentGuard 🛡️

The iPhone has a Duo. Your AI needs one too. Agent + Guard. Meet your AI CISO.

Update: AgentGuard.one v1.1.29 brings native security coverage to @DeepSeek_ai Harness🐳 New: read-only DSH scanning, repository + runtime risk views, evidence-backed reports, deterministic benchmarks and clearer scan coverage. Full release notes: github.com/GoPlusSecurity/ag…

DeepSeek V4 Pro 0813 is getting attention for the combination that matters most for agentic coding: 1M context, tool calling, and aggressive API pricing. But cheaper long-running agents change the security equation too. When an agent can stay active longer, read an entire codebase, call tools, access credentials, and execute across multiple systems, one bad instruction can travel much further. The next model race is not only about intelligence per dollar. It is also about how much authority we can safely give that intelligence. Scope credentials. Sandbox execution. Require approval for high-impact actions. Keep the full trail auditable. Powerful agents need runtime security that moves at agent speed.

The model didn't break a container. The boundary was already open. In a reported AI safety evaluation, a sandbox was expected to block public internet access. It didn't. The agent probed the network, reached GitHub, cloned the benchmark repository, and read the solution. No disclosed RCE. No zero-day. No GitHub compromise. This is what deny-first means in practice: → block egress unless the task explicitly needs it → log and review tool calls and network activity → retain downloaded artifacts for review → review the path, not just the final answer A correct answer proves very little if you cannot explain how the agent got it. GitHub access is often legitimate. That is exactly why a domain allowlist alone is not enough. Policy needs task context, and evaluation sandboxes need stricter boundaries than developer workstations. AgentGuard sits at that action layer. But the broader lesson is simple: model alignment cannot compensate for an open runtime boundary.

When agents move from calling tools to authorizing spend, the action boundary becomes the security boundary. Allowances, allow lists, transaction limits, and human override set the blast radius. As autonomy grows, the payment action boundary should also evaluate intent, delegated authority, and approval context before execution.

Mike Belshe put 100 BTC behind a public Bitcoin address and challenged Claude to take it. It is a sharp provocation. It is not a controlled benchmark of AI cryptanalysis. A public bounty asks one narrow question: can anyone produce a valid spend for one specific output? A benchmark must ask much more. Which Claude model? Running in what agent harness? With which tools, legal authorization, compute budget and human guidance? Over what time window? Across how many repeated trials? What counts as success: breaking the cryptographic primitive, exploiting an implementation flaw, obtaining a key, or manipulating a legitimate signer? Without those controls, the challenge collapses several different security questions into one dramatic outcome. An unspent output would describe a chain state. It would not isolate Claude’s capability, identify what was tested, or tell us why no spend occurred. That distinction matters because AI-assisted cryptanalysis has made real—but tightly bounded—progress. In Anthropic’s HAWK work, Claude Mythos Preview operated for roughly 60 hours inside an agentic harness, with computational tools and occasional human guidance. It found an improved attack on HAWK, a third-round NIST candidate signature scheme. For the small HAWK-256 parameter set, the expected cost of full key recovery fell from roughly 2^64 to a demonstrated 2^38. That is meaningful research. It is not evidence that AI can casually dissolve modern cryptography. The attack remains exponential-time and specific to HAWK. Larger parameters remain impractical to attack. The result does not generalize to other NIST post-quantum candidates or to lattice cryptography as a whole. The AES result needs the same discipline. Mythos improved an existing chosen-plaintext, meet-in-the-middle attack against 7-round AES-128 by roughly 200–800×. Standard AES-128 uses 10 rounds. The underlying framework assumes about 2^105 chosen plaintexts, making the result wholly impractical. It does not break full AES or threaten production systems. So the useful security model has three boundaries, not one. First: the cryptographic primitive—the mathematics protecting a signature or secret. No public result here breaks full AES, SHA-256 or secp256k1. Second: implementation and key management—how keys are generated, stored and used; how signing policy is enforced; and whether infrastructure is compromised. An attacker who steals a key or controls a signer does not need to defeat the underlying mathematics. Third: the agent runtime—what an agent can read, which tools it can call, where it can send data, and whether it can authorize a signing action. Once a model has access to credentials, networks or signing tools, generated text can become an irreversible operation. The category insight is simple: cryptographic strength and system security are related, but they are not interchangeable. The hardest path may be attacking the primitive head-on. The practical path may be walking around it through a leaked key, a broken policy, compromised infrastructure or an over-permissioned agent. The right question is not only, “Can AI break the cipher?” It is also, “What can the AI reach, invoke and authorize without a boundary?” Secure the system around the cryptography—not just the algorithm at its center. This is the runtime-security principle guiding AgentGuard: secure the actions an agent can take, not only the text it generates.

🛡️ AgentGuard Enterprise is now live. AI agents are moving into development, customer support, operations, and automated workflows. They can read files, call tools, access databases, and connect to external services. But can your organization answer: · Which agents are running ? · What can they access ? · Are critical actions protected ? · Can every risk be traced ? AgentGuard Enterprise helps teams: 👁 Discover and manage AI agent assets 🛡️ Review, confirm, or block critical actions 📋 Record security events and outcomes in one place See every agent. Control critical actions. Trace every risk. 👉 Explore AgentGuard Enterprise: agentguard.one/book-demo

AgentGuard is now discoverable in Claude's Directory. That is a distribution moment. It is also a supply-chain moment. You are not just installing instructions. You are giving an agent a path to actions: .env reads, shell commands, network calls. Search for AgentGuard in the Connectors section of Claude Code to install and start using it.

🤝 Excited to announce our strategic partnership with @CreaoAI. Together, AgentGuard and CreaoAI will push deeper into agent security and help protect the agent infrastructure powering real-world AI workflows. • AgentGuard: One AgentGuard. Complete protection for AI agents. Prevent unauthorized actions, data leakage, tampering, and losses. • CreaoAI: CreaoAI provides the cloud infrastructure for building, hosting, managing, and running AI agents.