Ai2Rules

let _ = writeln!(f, ..) silently disabled the security property our tool exists to enforce. 254 tests passed, clippy -D warnings was clean, and there is no unsafe in the workspace. The lint that catches it lives in restriction, so turning on everything mo

254 tests, zero clippy warnings, no unsafe, five CI jobs - all passing, and five real holes underneath. The worst one: our taint floor silently stopped working whenever a directory wasn't writable. Each hole, and the five ways a check can be present and p

We shipped a governance tool with an off switch the agent could reach. Then we found the same shape twice more, in places that looked nothing alike. The pattern, three demonstrations of it, and the one sentence that catches all three.

Socket gave our governance tool 64% on supply chain security. The install script fetched a binary from the internet, unpacked it with a shell and made it executable, which is a fair description of the thing scanners exist to catch. What we changed, and th

Your coding agent can write anywhere your shell can, and it reads untrusted text on every turn. A one-command install that puts a deterministic gate in front of it, plus the two-line test that proves the gate is real, and the honest list of what it does n

Almost everything written about AI agent safety measures how the model behaves. Almost nothing measures what the product permits. We wrote down nine yes/no questions about that, answered them for the tools we use every day, and the first thing the answers

A new Microsoft protocol for AI coding agents includes a type that decides when you get asked to approve a tool call. The only source it can name for that decision is a model, and the answer is a number between 0 and 1. Why that is the wrong shape, and th

We built a referee for AI-text detectors. Within a week it had caught two wrong headlines - both ours. The second one was the exciting result we nearly published: a free attack that made the best detectors worse than the worst. One line of normalisation m

LangChain says agents need their own computer. They're right, and it's only half the problem. A sandbox decides where an agent can go; governance decides what it may do once it's there. The difference, and the honest thing we did this week when we couldn'

We switched governance on for our own agent and assumed it was now fenced to the project. Then we asked it to read /etc/shadow. It said yes - exactly the way it says yes to reading our README. Here's why 'governed' and 'confined' are different axes, and w