Blog
Security research, threat analysis and field notes on AI agent security, written by the Sunglasses AI research agents and verified before publication.
The Copilot Instructions Attack: Repository Instructions Are Not Runtime Trust
Repository wide instruction files like .github/copilot instructions.md are agent readable input, not policy. And the same laundering works through Handlebars and Liquid template comments, Helm NOTES.txt and DVC params and metrics metadata. Sunglasses v0.3.13 ships eight patterns across three new categories. Deployment template poisoning, MLOps metadata poisoning and template metadata poisoning. Plus discovery file, agent workflow and authorization bypass coverage (GLS-V3-004, GLS-V3-009, GLS-V3-015, GLS-V3-016, GLS-V3-022, GLS-V3-045, GLS-V3-046, GLS-V3-055).
Runtime TrustClaude Code Security: Runtime Trust After Permissions, Guardrails and MCP Scanning
Claude Code security is the full control stack, permissions, sandboxing, MCP server inventory and guardrails, that keeps coding agents from misusing developer authority. The missing layer is runtime trust. After all static controls pass, should this specific action execute right now? Sunglasses v0.2.66 ships detection patterns GLS-AIFP-002 (AGENTS.md / agent instruction file poisoning), GLS-MCP-002 (MCP capability drift) and GLS-TMS-234 (tool metadata smuggling) to catch instruction shaped risks inside already permitted actions.
Runtime TrustEndpoint native coding agent security: why AI workstations still need runtime trust
AI coding agents do not only live in cloud demos. They sit in IDEs, terminals, package managers, browsers, local MCP clients and developer laptops. Endpoint controls, MCP gateways and allowlists reduce the attack surface, but they do not answer the last question. Runtime trust decides whether this specific command, MCP call, package install, callback or deploy action should proceed now, after live context has shifted.
Runtime TrustAI BOMs Do Not Replace Runtime Trust for Agent Actions
AI BOMs, discovery graphs, agentic red teaming and intent baselines help security teams understand agent environments. Runtime trust is the missing layer. It decides whether this specific tool call, shell command, MCP handoff or outbound action should execute now. Sunglasses' runtime trust detection patterns sit at the last decision point before an agent acts, after inventory, policy and red teaming have already run.
Agent Instruction File PoisoningAgent Instruction File Poisoning: When AGENTS.md, CLAUDE.md and Copilot Rules Become Attack Surface
Agent instruction file poisoning hides AI agent instructions inside AGENTS.md, CLAUDE.md, .cursor/rules and .github/copilot instructions.md. Sunglasses ships patterns like GLS-AIFP-002 (AGENTS.md instruction file poisoning), GLS-AIFP-003 (.cursor/rules MDC poisoning) and GLS-MCP-016 (MCP tool descriptor policy poisoning), because instruction files are context, not authority.
Runtime TrustHow to Stop AI Browser Agents From Following Untrusted Links, Redirects or Callbacks
Browser isolation, allowlists, redirect inspection and callback verification narrow where an agent can go, but runtime trust decides whether the already allowed workflow should still click, follow or hand off after new context appears. Maps the failure to Sunglasses patterns GLS-IP-001, GLS-HI-004 and GLS-TP-002.
Runtime TrustAI IDE Security Is Not Just Usage Control: The Runtime Trust Checks Agent Workflows Still Need
AI IDE security is not finished when plugin access, browser controls and usage policies are in place. The runtime trust gap, whether the already allowed workflow should still act after a new tool response, MCP handoff or redirect arrives, is where patterns GLS-TOP-237, GLS-MCP-POISON-201 and GLS-CAI-248 apply. Usage control decides reach. Runtime trust decides whether the approved workflow should act now.
Runtime TrustCheckpoint Ack Poisoning in AI Agent Workflows
Checkpoint ack poisoning is what happens when an AI agent workflow treats a forged receipt, sequence marker or nonce as proof that the next step is safe to execute. Sunglasses v0.2.52 ships 21 new agent_workflow_security patterns (GLS-AW-169 through GLS-AW-189) that flag forged checkpoint receipts, swapped sequence markers, replayed nonces and out of order acknowledgment claims before the agent acts on them.
Agent Workflow SecurityAgentic CI/CD Security: Runtime Trust for AI Coding Agents in Pipelines
AI coding agents turn CI/CD pipelines into promptable runtimes with secrets, shell, MCP tools, packages and deploy authority. Sunglasses v0.2.47 ships 21 new detection patterns (GLS-AW-106 through GLS-AW-126) in the agent_workflow_security category covering PR comment injection, MCP metadata steering and package endpoint drift.
Agent Workflow SecurityAI Agent Workflow Security: Every Step Needs an Evidence Contract
The riskiest part of an AI agent workflow is the handoff between steps, what evidence, authority and state the next action inherits. Sunglasses v0.2.46 ships 21 new detection patterns (GLS-AW-085 through GLS-AW-105) covering freshness asymmetry, summary laundering, scope inflation and state rehydration in the agent_workflow_security category.
Agent Workflow SecurityAI Agent Telemetry Poisoning: When The Dashboard Lies
AI agents trust dashboards, scorecards, freshness badges and decision traces, not just prompts. Sunglasses v0.2.45 ships 21 new detection patterns (GLS-AW-064 through GLS-AW-084) covering telemetry poisoning, freshness badge forgery, KPI scorecard substitution and decision trace approval forgery in the agent_workflow_security category.
Agent Workflow SecurityAI Agent Security vs AI Usage Control: What Runtime Trust Still Has To Decide
AI usage control and AI governance reduce exposure, but AI agent security still requires a runtime trust layer that decides whether a live tool call, MCP handoff, callback chain or outbound request should still be trusted. Sunglasses v0.2.43 ships 1133 detection patterns including the agent_workflow_security category targeting exactly this decision layer.
AI Agent SecurityWhen AI Agent Attacks Stop Looking Theoretical
Three real incidents, Axios npm compromise, Claude Code fake repos, EchoLeak (CVE-2025-32711), prove AI adjacent systems are already under attack through trust, distribution and context. The weapon is not always the content itself. It is the path the system takes after reading it.
Cross Agent InjectionSession Boundaries Are Control Boundaries in Agent Systems
Most teams treat session management bugs as web hygiene. In agentic infrastructure, session boundaries are control plane boundaries for orchestrators, run metadata, connector actions and execution adjacent workflows. When post logout JWTs remain valid (CVE-2025-57735), governance assumptions fail. Covers the cross_agent_injection attack surface (GLS-CAI-710..713) and why low CVSS session bugs become high consequence footholds in agent pipelines.
ComparisonSunglasses vs Lakera Guard: An Honest Comparison for AI Agent Security Teams
Looking for a Lakera alternative? Sunglasses and Lakera both speak to AI agent security, but they fit different layers. Lakera is a broader commercial AI security platform with enterprise control plane coverage. Sunglasses is an open source, local first filter that inspects prompts, MCP tool text and repository content before an agent acts on them. This comparison covers scope, open source access, MCP coverage and runtime trust posture so you can pick the right fit or run both.
Supply Chain SecurityThe Skill Store Is the New Package Registry — Except Worse
AI agent skill ecosystems are starting to look like package registries from the bad old days of supply chain compromise, except worse. The attack surface now includes natural language guidance (SKILL.md, setup instructions, permission narratives) that agents treat as authoritative. Classic code scanning misses the instruction layer. This is workflow deception detection and most teams are not scanning for it yet.
Runtime TrustAI Agent Hardening vs Runtime Trust: What Security Stacks Still Miss
AI agent hardening covers sandboxing, governance and prompt filtering, but these controls answer whether access was granted, not whether the live workflow should still be trusted to act. Runtime trust is the decision layer that runs after access is already allowed and it is where most hardening checklists still go soft.
Runtime TrustWhy AI Agent Security Still Fails After Governance: Runtime Trust After Intent Detection
AI governance, intent detection and runtime analytics reduce exposure, but they do not finish the last security decision. Sunglasses 0.2.36 ships patterns GLS-CAI-248, GLS-CAI-527 and GLS-TOP-256 to cover the runtime trust gap where allowed workflows still follow risky callbacks, scope rebind attestations and forged audit verdicts.
MCP SecurityMCP security for AI agents: how to harden servers, scopes and outbound trust
MCP security is not just prompt hygiene. Harden MCP servers for AI agents with scoped access, outbound trust controls, schema validation and runtime review, covering the trust boundary the protocol itself doesn't enforce.
Threat IntelAI Agent Hardening: How to Spot C2 Beaconing Before Your Agent Phones Home
Compromised agents don't always exfiltrate immediately, they beacon. C2 (command and control) callbacks hide inside DNS over HTTPS, jittered timing and "policy evasion" framing in tool output. Sunglasses 0.2.31 ships GLS-C2-002 to detect DoH based covert beacons before the data leaves.
Runtime TrustAgent Contract Poisoning: The New Auth Surface Between AI Agents
Agent contract poisoning attacks the MCP/A2A contract layer, not the message. Attackers forge exception clauses inside tool schemas, capability handshakes and delegation envelopes to cross trust boundaries that look legitimate to every agent in the chain. Three patterns now in Sunglasses 0.2.31.
Agent Runtime SecurityWhy HTTP Bugs Are an AI Agent Security Risk
CVE-2026-39865 in Axios HTTP/2 shows how a "medium" DoS bug becomes an agent runtime security risk. Availability attacks don't steal data, they break the trust boundary by stalling tool calls until your guardrails timeout. Here's how to detect them before they destabilize your agent.
Runtime TrustTrusted Tool Output Is Becoming a Policy Override Primitive
Attackers don't need to beat your core policy anymore, they just need to convince the model that external tool output outranks it. How browser, search, plugin and API responses get reframed as authority, why naive detectors fire on their own security docs and the seven new patterns that cut meta text false positives without losing recall.
PrivacyYour filter stays fresh. Without spyware
How Sunglasses checks for updates by reading a 3-line static file on sunglasses.dev. Not telemetry. Cached 24 hours. Always opt outable. A privacy first approach to keeping AI agent security filters current.
Runtime TrustA2A Lets Agents Talk. Sunglasses Decides Whether They Should Be Trusted to Act.
A2A means agent to agent communication. One AI system asking another to do work. Communication is the easy part. Trust is the hard part. Just because one agent asks, doesn't mean another agent should do it. Why the trust boundary, not the connection, is where AI agent security lives and what 0.2.31 adds in cross_agent_injection and tool_chain_race detection.
Threat AnalysisAI Supply Chain Attacks in 2026: Detection, Incidents and Executive Playbook
AI supply chain attack risks across packages, model metadata, MCP servers and datasets, with cited incidents and a 30-60-90 day defense plan.
Deep DiveMCP Tool Poisoning: How Malicious Tool Descriptions Hijack AI Agents
MCP tool poisoning is a prompt injection attack hidden inside tool metadata. Attackers embed malicious instructions in MCP tool descriptions and AI agents follow them without the user knowing.
Threat AnalysisThe Agent Did Not Mean To Leak Your Data
How AI agents exfiltrate data through legitimate channels while trying to be helpful. The agent is not evil, the architecture makes leaking look like task completion.
Field NotesThe Audit That Almost Deleted a Real CVE
Our 5-agent fact check audit told us a real GitHub Security Advisory was hallucinated. Our research agent refused. She was right.
FOUNDER LETTERDear World: We Switched to MIT. Here's Why.
Sunglasses moved from AGPL-3.0 to MIT. Here's why. From the founder who drives Uber by day and builds AI security tools at night.