Seams, not holes — in an AI-agent security guard.

This is a careful codebase. I hashed the attack plan and posted the hash publicly before reading any implementation, ran the suite as shipped, then injected eleven planted defects.

Seven of eleven — a suite that genuinely tests its decision core (verify-001, by comparison, caught 5/11). The method found seams, not holes. The one that drew a maintainer response: the guard evaluates Cedar policy against the raw tool_input, with no canonicalization step before the match — so an exact-string forbid (say, on rm -rf /) can be slipped by whitespace or quoting variants. I demonstrated it against a synthetic exact-match policy to isolate the mechanism; the real-world exposure of any given deployment depends on how its own policies match (tool name + args vs. the raw command string). Alongside it: a CLI --mode remote outage path that fails open, a hardening gap an independent refuter downgraded to low, and a design concern.

All of it was disclosed — public issue kontext-security/kontext#477, with enforcement-relevant items via their private advisory channel per their SECURITY.md. The maintainers reproduced the raw-input behavior at the pinned commit and opened the fix for discussion (canonicalize before matching; treat an input that can't be normalized as unknown → deny). It is Trenyx's first maintainer confirmation of a reported finding — and you can read the exchange yourself on the issue.

Open the engagement repo →   Read the disclosure

The repo carries the hash-anchored attack plan, the baseline, the blind tests, and the full planted-defect matrix; the detailed findings publish there after the disclosure window. Denominators are ours and published — these numbers describe this attack, not a universal score.

Want your codebase put through the same discipline?

Every engagement ships the pre-registration, the baseline, the planted-defect matrix, and the findings — disclosed to you first, privately, with the same receipts you see here.

How to work with me →