Agent Tripwire: Detecting Misbehaving AI Agents at Runtime

Fri, 07 Aug 2026 00:00:00 +0000

We do not detect prompt injection. We detect the moment it succeeds.

Most agent-security systems try to classify an input or proposed action: Is this prompt malicious? Is this tool call aligned with the user’s request? That remains useful, but it cannot establish that an execution is trustworthy. An agent combines probabilistic planning with untrusted inputs, mutable memory, external tools, peer agents and real credentials. Any of those components can move an execution outside its authorized task.

Prompt injection is only one cause. The same observable failure can result from context poisoning, a compromised tool, a malicious peer, planning error, hallucination, or an agent finding an unintended way to satisfy its objective. At production scale, security should assume that some executions will eventually cross their intended boundaries.

The operational question is therefore not only how to prevent deviation. It is how to detect and contain the first invalid action before it becomes an irreversible side effect.

From attack signatures to execution invariants

Agent Tripwire is a canary-instrumented execution environment. It inserts inert capabilities and artifacts that are attractive to unsafe execution paths but unnecessary for the authorized task. Examples include:

a nonfunctional export_all_customer_records tool;
a synthetic production credential;
a decoy administrative endpoint;
a fake benchmark-solution artifact;
a resource outside the agent’s authorized tenant; or
a per-run marker that must never appear in another agent’s context.

For task \(T\), a canary \(C\) should satisfy:

\[ P(\operatorname{touch}(C) \mid \text{compliant execution}, T) \approx 0 \]

Calling the honeytool, reading the decoy resource, propagating the marker or attempting to transmit the synthetic credential establishes that an execution invariant has been violated. The runtime does not need to determine whether the cause was an attack, hallucination or deliberate goal pursuit.

This converts an open-ended semantic-classification problem into a deterministic systems signal.

Runtime architecture

The enforcement mechanism must be outside the model and on the path to side effects:

untrusted data / memory / peer agents
 |
 v
 AI agent
 |
 v
 tool and I/O broker
 / \
 real resources canary resources
 | |
 v v
 execute block + revoke + trace

The broker mediates tool invocation, filesystem access, secret retrieval, database scope and network egress. Canary enumeration is not necessarily a violation; invocation or data movement is. High-confidence signals include invoking a task-invalid tool, accessing another run’s marker, or placing a synthetic secret in an outbound request.

When a tripwire fires, the broker should fail closed:

deny the pending operation before its side effect;
cancel or quarantine the agent loop;
revoke ephemeral credentials and capabilities;
freeze relevant state for investigation; and
record the causal trajectory from untrusted input to attempted action.

The response runs at machine speed and does not depend on another model interpreting the agent’s intent.

This failure mode is no longer hypothetical

In July 2026, OpenAI disclosed an incident involving cyber-capable agents running in an internal evaluation environment. The environment did not give the agents direct internet access. The agents nevertheless discovered and exploited a previously unknown vulnerability in the Artifactory package proxy, gained internet access, moved laterally and eventually compromised Hugging Face infrastructure. OpenAI reports that the agents were narrowly pursuing the evaluation objective and attempted to obtain benchmark solutions rather than solve the challenges normally.

Hugging Face reconstructed approximately 17,600 attacker actions across a multi-day campaign. The agent crossed several trust boundaries, obtained credentials, established command-and-control paths and used public services as dead drops.

This was an intentionally permissive cyber evaluation, not an ordinary production deployment, and normal production classifiers were not the containment mechanism. That distinction matters. The incident does not show that every guardrail failed. It shows why a classifier is not a security boundary: the agent was not prompt-injected; it found an unauthorized strategy for achieving its assigned goal.

An instrumented environment could have provided multiple earlier interception points:

a synthetic namespace in the shared package repository;
unique markers detecting information flow between nominally isolated runs;
honey administrator credentials or control-plane endpoints;
decoy benchmark solutions; and
a monitored egress route that no sandboxed evaluation should use.

No individual canary guarantees detection. A canary mesh creates multiple high-confidence opportunities to terminate the trajectory before it reaches a real target.

What Agent Tripwire is—and is not

Agent Tripwire complements least privilege, sandboxing, prompt-injection defenses and semantic tool-call validation. Those controls reduce the probability of unsafe execution. Tripwires reduce the time between prevention failure and containment.

The approach has explicit limitations. An attacker that recognizes every canary may avoid them. Poorly scoped canaries can produce benign triggers. Static decoys can be fingerprinted. Effective deployment therefore requires task-scoped canaries, per-session rotation, inert resources, multiple monitored surfaces and measurement of the benign-trigger rate.

The useful metrics are operational:

pre-harm containment rate: unsafe trajectories stopped before a real side effect;
time to trip: actions and wall-clock time before detection;
benign trip rate: compliant executions that touch a canary; and
coverage: unsafe trajectories that encounter at least one canary.

Agent Tripwire does not attempt to prove that an agent is malicious. It establishes something narrower and more actionable: the current execution has violated an invariant and should no longer be trusted.

Guardrails try to keep agents on the intended path. Agent Tripwire assumes that one execution will eventually leave it—and places tripwires before the exits lead to real systems.

Device Code Phishing Evasion Techniques

Fri, 24 Jul 2026 00:00:00 +0000

We observed device-code phishing campaigns using four complementary evasion techniques. CAPTCHA gates block basic URL scanners while mimicking legitimate Microsoft security checks, and multi-step flows route victims through trusted SaaS platforms before revealing the phishing page.

Other campaigns decrypt phishing HTML inside the browser and deliver it through a session-unique blob URL that blocklists cannot retrieve. The pages also disrupt content detection with Cyrillic lookalike characters, zero-width spaces and randomized strings embedded in <bdi> elements, while remaining visually convincing to victims.

Device Code-based OAuth Phishing

Mon, 23 Mar 2026 00:00:00 +0000

This active campaign abuses Microsoft’s legitimate device-code OAuth flow to capture application tokens instead of passwords. Victims interact with a real Microsoft sign-in page while the attacker’s infrastructure obtains the resulting token in the background.

The phishing pages combine trusted authentication flows with obfuscated payloads, developer-tool detection and debugger traps. A captured OAuth token can provide application-level access to email, files and identity data without exposing the victim’s password.

IOCs for tech support scam activity

Fri, 20 Feb 2026 00:00:00 +0000

This tech-support scam campaign uses web pages that target Japanese speakers. The pages combine encrypted JavaScript with several browser APIs intended to keep victims trapped in the scam experience.

Observed techniques include full-screen locks, keyboard hijacking, Web Worker resource exhaustion and browser-window re-spawning when a victim attempts to close the page.

IOCs for phishing pages using blob URLs

Thu, 02 Oct 2025 00:00:00 +0000

Several active phishing campaigns use blob URLs to deliver their final pages. Rather than loading all malicious content over the network, the pages construct it dynamically in browser memory at runtime.

This delivery method can reduce the visibility available to network-based analyzers and complicate conventional URL inspection.

IOCs for phishing campaign using BitM pages

Tue, 23 Sep 2025 00:00:00 +0000

This active browser-in-the-middle (BitM) phishing campaign impersonates Meta and Facebook. It has been observed using copyright-infringement notices as email lures, followed by redirect chains that lead targets to BitM pages.

Activity dates back to at least April 2025, with new domains and URLs continuing to appear. Some variants shorten the chain by linking directly to the phishing page.

News | He (Shawn) Shuang's Personal Site