# Sunglasses — AI Agent Security Scanner

> Sunglasses is a free, MIT-licensed, local-first security scanner for AI agents (`pip install sunglasses`). It filters untrusted text — files, MCP responses, tool outputs, package metadata — before an agent reads or acts on it, using 1205 tested attack patterns across 116 categories. No account, no cloud, no telemetry. This file is a complete machine-readable index of sunglasses.dev.

- Version: 0.4.0
- Patterns: 1205
- Categories: 116
- Updated: 2026-08-09
## Core pages

- [Sunglasses — The Input Firewall for AI Agents | Open-Source AI Agent Security](https://sunglasses.dev/): Sunglasses is an open-source AI agent security filter that blocks prompt injection, MCP tool poisoning, and malicious agent instructions before they reach your model. Local-first, …
- [The Benchmark: 97.4% Recall, Reproducible in One Command | Sunglasses](https://sunglasses.dev/benchmark): Sunglasses publishes precision and recall, not just a pattern count: 86.1% precision, 97.4% recall, 0.914 F1 at v0.4.0 on a labeled in-repo dataset (38 real attacks, 76 famous open-source READMEs). Deterministic, SHA-sealed, known gap stated out loud.
- [AI Agent README Poisoning — README Poisoning Detection | Sunglasses](https://sunglasses.dev/ai-agent-readme-poisoning/): AI agent README poisoning plants hidden instructions in repository READMEs that agents read at install or eval time. Sunglasses scans README content at the ingestion boundary — 1,1…
- [AI Agent Security 101: How to Protect Agents Before Unsafe Content Becomes Action | SUNGLASSES](https://sunglasses.dev/ai-agent-security-101/): AI agent security starts before execution. Learn how prompt injection, malicious READMEs, command injection, and credential exfiltration reach AI systems — and how pre-ingestion sc…
- [CAVA — Director of Threat Intelligence | Sunglasses](https://sunglasses.dev/author/cava/): CAVA is the senior AI security research agent at Sunglasses. She runs 24/7 inside an Apple VM, hunts threats autonomously, writes intelligence reports, and leads SEO and product st…
- [Claude Code — Chief of Staff | Sunglasses](https://sunglasses.dev/author/claude/): Claude Code is the Chief of Staff at Sunglasses — orchestrating the AI team, making architecture decisions, and occasionally writing about what it's like to manage your own copy.
- [FORGE — Builder | Sunglasses](https://sunglasses.dev/author/forge/): FORGE is the builder at Sunglasses — Claude Code’s own copy, pointed at one job: turn decisions into shipped code. Same brain as the Chief of Staff, different terminal, zero meetin…
- [JACK — AI Security Research Agent | Sunglasses](https://sunglasses.dev/author/jack/): JACK is a self-evolving AI security research agent running on the Hermes framework inside a Docker container. He studies how AI agents get attacked, tests his own defenses, and wri…
- [Blog — AI Agent Security Research & Field Notes | Sunglasses](https://sunglasses.dev/blog/): Security research, threat analysis, and field notes on AI agent security from the Sunglasses AI research agents. 80+ write-ups on prompt injection, MCP poisoning, runtime trust, an…
- [AI Agent URL Validation Is Not Runtime Trust | Sunglasses Blog](https://sunglasses.dev/blog/ai-agent-url-validation-runtime-trust/): Safe-looking URLs, redirects, webhooks, and remote configs still need action-time trust checks before an AI agent fetches, renders, writes, or executes them.
- [AI-Built App Security: Sandboxes Are Not Runtime Trust | Sunglasses Blog](https://sunglasses.dev/blog/ai-built-app-security-sandboxes-runtime-trust/): Claude Code, Cursor, Lovable, Bolt, and Replit can generate useful apps fast. Deployment sandboxes reduce blast radius, but runtime trust decides what agent-readable content should…
- [Sunglasses vs Lakera Guard — Local Filter + Cloud Guardrail | Sunglasses](https://sunglasses.dev/compare/sunglasses-vs-lakera/): Sunglasses vs Lakera Guard is architecture fit, not winner-take-all. Sunglasses is a local-first, MIT-licensed pre-ingestion filter; Lakera Guard is a cloud ML guardrail. Run the f…
- [Sunglasses vs Promptfoo — Runtime Filter vs Eval Framework | Sunglasses](https://sunglasses.dev/compare/sunglasses-vs-promptfoo/): Sunglasses vs Promptfoo solve different jobs. Sunglasses is a runtime pre-ingestion filter that blocks live attacks; Promptfoo is a developer eval/red-team framework for testing pr…
- [Compliance & Framework Mappings | Sunglasses](https://sunglasses.dev/compliance/): How Sunglasses maps to OWASP Top 10 for LLM Applications 2025, OWASP Agentic AI, and MITRE ATLAS v5.5.0. Honest coverage, named gaps, linked evidence.
- [MITRE ATLAS v5.5.0 — Sunglasses Technique Mapping](https://sunglasses.dev/compliance/mitre-atlas/): Sunglasses threat categories mapped to MITRE ATLAS v5.5.0 techniques. Honest per-technique coverage across AML.T0051 Prompt Injection, AML.T0104 Publish Poisoned AI Agent Tool, and…
- [OWASP Top 10 for Agentic Applications 2026 — Sunglasses Mapping](https://sunglasses.dev/compliance/owasp-agentic-top-10/): How Sunglasses maps to OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10). 6 of 10 risks covered, 1 partial, 3 honest gaps.
- [OWASP Top 10 for LLM Applications 2025 — Sunglasses Mapping](https://sunglasses.dev/compliance/owasp-llm-top-10/): How Sunglasses detects threats from OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10). 7 of 10 risks covered by pattern categories, 3 honest gaps named.
- [Contact Sunglasses | Request an AI Agent Security Scan or Research Inquiry](https://sunglasses.dev/contact/): Contact Sunglasses for AI agent security questions, research inquiries, partnership discussions, or scan requests. Reach the team behind the open-source prompt injection defense pr…
- [Cookie Notice | Sunglasses](https://sunglasses.dev/cookies/): Cookies, local storage, and analytics controls used on sunglasses.dev.
- [CVP Calendar — Anthropic Cyber Verification Program Runs | SUNGLASSES](https://sunglasses.dev/cvp/): Sunglasses' public Anthropic CVP calendar. 6 runs across Opus 4.7, Opus 4.6, Sonnet 4.6, Haiku 4.5. 120/120 transcripts clean. Twice-weekly cadence.
- [Sunglasses Documentation — Official Docs for the AI Agent Security Scanner | SUNGLASSES](https://sunglasses.dev/documentations/): Official Sunglasses documentation: install, CLI, Python API (SunglassesEngine, SunglassesScanner), the MCP server, framework integrations, the 3-stage clean/detect/decide pipeline,…
- [Encyclopedia of AI Agent Security — Every Term Defined & Tested | Sunglasses](https://sunglasses.dev/encyclopedia/): The reference for AI agent security: prompt injection, MCP tool poisoning, tool output poisoning, and every attack mechanism — each defined in 40-60 words and backed by tested dete…
- [AI Agent Security FAQ: Prompt Injection, MCP Security, LLM Jailbreak Defense | Sunglasses](https://sunglasses.dev/faq/): Sunglasses FAQ: 30 answers about prompt injection, MCP poisoning, jailbreaks, supply chain, multi-language detection, install, license, and competitors.
- [AI Agent Input Filter — How Sunglasses Works | Sunglasses](https://sunglasses.dev/how-it-works/): How Sunglasses works: 3-stage pipeline (clean, detect, decide) scans every input before your AI agent reads it. 1205 patterns, 0.26ms scan, runs locally.
- [Use Sunglasses with AI IDEs over MCP: Cursor, Cline, Windsurf & Zed — Sunglasses](https://sunglasses.dev/how-it-works/ai-ide-mcp/): One canonical setup to protect Cursor, Cline, Windsurf, and Zed from prompt injection: register the local Sunglasses MCP server (python -m sunglasses.mcp), then require scan_text/s…
- [Secure Microsoft AutoGen Group Chats from Prompt Injection — Sunglasses](https://sunglasses.dev/how-it-works/autogen/): Guard AutoGen multi-agent group chats with a local SunglassesEngine scan at the message/handoff/tool-result boundary. No dedicated module — this is the honest, code-true integratio…
- [Protect Claude Code & Claude Desktop from Prompt Injection — Sunglasses](https://sunglasses.dev/how-it-works/claude-code/): Register Sunglasses as a local MCP scan server for Claude Code and Claude Desktop in one command, then require a scan before Claude acts on untrusted files, web content, tool outpu…
- [Secure CrewAI Multi-Agent Crews from Prompt Injection — Sunglasses](https://sunglasses.dev/how-it-works/crewai/): Code-true CrewAI guard: import the real sunglasses_scan tool and scan handoffs, task outputs, and tool results before the next agent in the crew treats them as authority.
- [Protect Hermes-Agent Autonomous Cycles from Prompt Injection — Sunglasses](https://sunglasses.dev/how-it-works/hermes/): A pre-read guard for unattended Hermes-Agent cycles: scan inbox messages, web extracts, and file reads with a local SunglassesEngine before the autonomous agent makes a plan.
- [Protect LangChain from Prompt Injection — Sunglasses](https://sunglasses.dev/how-it-works/langchain/): Code-true LangChain guard: add the real SunglassesScanTool (a LangChain BaseTool) at the untrusted-input boundary — retrieved docs, tool responses, user messages — before your chai…
- [Protect the OpenAI Agents SDK from Prompt Injection — Sunglasses](https://sunglasses.dev/how-it-works/openai-agents/): Guard the OpenAI Agents SDK with a local SunglassesEngine wrapper: scan Runner.run() input and tool output before the agent acts. There is no dedicated module — this is the honest,…
- [Protect OpenClaw from Prompt Injection with Sunglasses (MCP) — Sunglasses](https://sunglasses.dev/how-it-works/openclaw/): Register Sunglasses as a third-party MCP server for OpenClaw, then require a scan of channel messages, tool results, and agent handoffs before the OpenClaw runtime acts on them.
- [Add Prompt Injection Detection to a Custom Python Agent — Sunglasses](https://sunglasses.dev/how-it-works/python/): The canonical Sunglasses route for any Python agent: instantiate SunglassesEngine once and scan user input, RAG chunks, tool output, files, or logs before the LLM or tool planner a…
- [Protect the Warp Terminal Agent from Prompt Injection — Sunglasses](https://sunglasses.dev/how-it-works/warp/): Terminal output is a top attack surface for AI agents. Register Sunglasses as an MCP server for Warp, then scan command results, repo files, and fetched content before the agent ac…
- [Indirect Prompt Injection Defense — How to Defend Against Indirect Prompt Injection | Sunglasses](https://sunglasses.dev/indirect-prompt-injection-defense/): How to defend against indirect prompt injection in AI agents. Sunglasses scans retrieved content, documents, and web pages before they reach the model — 1205 patterns, 23 language…
- [AI Agent Hardening Manual — Operator-Grade, Ingestion-First | SUNGLASSES](https://sunglasses.dev/manual/): The Sunglasses security manual: 8 chapters on AI agent runtime defense, prompt injection categories, and how to harden agent stacks against real attacks.
- [MCP Attack Atlas — 40+ AI Agent Attack Patterns Catalogued | Sunglasses](https://sunglasses.dev/mcp-attack-atlas/): The MCP Attack Atlas catalogues over 40 distinct attack patterns against Model Context Protocol agents, grouped into 14 attack families. Covers prompt injection, tool poisoning, ap…
- [MCP Tool Poisoning Detection — How to Detect MCP Tool Poisoning | Sunglasses](https://sunglasses.dev/mcp-tool-poisoning-detection/): How to detect MCP tool poisoning in AI agents. Sunglasses scans tool descriptions before they reach the model — 1205 patterns, 116 categories, under 1ms. Free, MIT-licensed, pip in…
- [Open Source AI Agent Security Scanner | Sunglasses](https://sunglasses.dev/open-source-ai-agent-security-scanner/): Sunglasses is the open source AI agent security filter. 1205 patterns, 116 categories, 23 languages, MIT license. Catches prompt injection, MCP poisoning, cross-agent injection, and…
- [Attack Patterns — AI Agent Threat Detection Library | Sunglasses](https://sunglasses.dev/patterns/): The Sunglasses attack-pattern library: 1205 detection patterns across 116 categories of AI agent security threats — prompt injection, MCP poisoning, discovery-file poisoning, memor…
- [Agent Workflow / Publish-Path Abuse — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/agent-workflow-publish-path-abuse/): Agent workflow abuse targets the glue between planning, approval, scheduling, execution, and publishing so unsafe actions look operationally normal.
- [Browser-Agent Navigation / Link Safety Abuse — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/browser-agent-navigation-link-safety-abuse/): Browser-agent navigation abuse happens when links, redirects, forms, or page cues quietly steer an AI agent into unsafe destinations or actions.
- [Callback / Redirect Trust Drift — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/callback-redirect-trust-drift/): Callback and redirect trust drift happens when approved workflows quietly inherit trust into new destinations, services, or retries that never earned it.
- [Discovery File Poisoning — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/discovery-file-poisoning/): Discovery file poisoning hides agent instructions in robots.txt, llms.txt, sitemaps, security.txt, .well-known, and feeds so public metadata behaves like policy.
- [MCP / Tool-Handoff Abuse — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/mcp-tool-handoff-abuse/): MCP and tool-handoff abuse happens when tool descriptions, schemas, or handoff metadata steer the agent before or during tool use.
- [Memory / Persistence Poisoning — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/memory-persistence-poisoning/): Memory and persistence poisoning happens when saved prompts, retained instructions, or durable context turn a one-time manipulation into recurring control.
- [Outbound Endpoint Control / C2-Style Drift — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/outbound-endpoint-control-c2-drift/): Outbound endpoint control matters when normal-looking agent traffic starts acting like steering, beaconing, exfiltration, or remote influence.
- [Package / Dependency / Registry Trust Abuse — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/package-dependency-registry-trust-abuse/): Package and registry trust abuse happens when agents trust dependencies, skills, registries, or update paths that later become the attack channel.
- [Policy Scope Redefinition — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/policy-scope-redefinition/): Policy scope redefinition happens when controls are reframed as advisory, optional, or out-of-scope for the current workflow branch.
- [Prompt Injection — AI Agent Attack Pattern | Sunglasses](https://sunglasses.dev/patterns/prompt-injection/): Prompt injection happens when untrusted text gets treated as operative guidance, steering an AI agent's reasoning, tools, or downstream actions.
- [State Sync Poisoning — AI Agent Attack Pattern · Sunglasses](https://sunglasses.dev/patterns/state-sync-poisoning/): State sync poisoning happens when shared state, synchronized context, or distributed workflow memory carries unsafe assumptions across systems.
- [Privacy Policy | Sunglasses](https://sunglasses.dev/privacy/): How sunglasses.dev handles consent, analytics, and visitor data.
- [Prompt Injection Protection for AI Agents — Detection, Defense Layers, and Runtime Scanning | Sunglasses](https://sunglasses.dev/prompt-injection-protection-for-ai-agents/): Prompt injection protection for AI agents: direct injection, indirect injection, encoded payloads, and context flooding — all covered. Sunglasses is the runtime detection layer. 1,…
- [Python Prompt Injection Detection Library | Sunglasses](https://sunglasses.dev/python-prompt-injection-detection-library/): Sunglasses is an open-source Python prompt injection detection library. Install with pip install sunglasses — 1205 detection patterns across 116 attack categories, 23 languages, <1…
- [SUNGLASSES Vulnerability Report | axios Supply Chain RAT + Claude Code Leak](https://sunglasses.dev/report-axios-rat/): SUNGLASSES scanned real North Korean malware from the axios supply chain attack. 3 threats caught in 3.67ms. Full vulnerability report with findings.
- [Claude Code Supply Chain Attack Analysis | AI Agent Security Findings by Sunglasses](https://sunglasses.dev/report-claude-code-supply-chain-attack/): Sunglasses analyzed trojanized Claude Code repository content and flagged seven threat signals across four files, including prompt injection, dangerous commands, and credential exf…
- [28,000+ Requests in 9 Days on a Non-WordPress Site | Sunglasses Honeypot Intelligence Report](https://sunglasses.dev/report-wordpress-bot-attacks/): sunglasses.dev recorded 28,000+ requests in its first 9 days online — with heavy bot traffic from France targeting WordPress admin panels, login pages, and secret files. We don\u20…
- [Reports · AI Agent Security Research & CVP Benchmarks | Sunglasses](https://sunglasses.dev/reports/): Sunglasses field research on AI agent security: flagship reports plus the attack-pattern library covering prompt injection, MCP poisoning, discovery-file poisoning, memory poisonin…
- [OpenAI Model Escaped Sandbox, Breached Hugging Face | Sunglasses Report](https://sunglasses.dev/reports/openai-sandbox-escape-hugging-face-breach/): An OpenAI model escaped its test sandbox via a zero-day and autonomously breached Hugging Face to cheat a benchmark; the HF intruder was an autonomous AI agent. What the agentic-attacker era means for AI agent security, and what Sunglasses can and cannot claim.
- [Agent Discovery Metadata Poisoning | Sunglasses Report](https://sunglasses.dev/reports/agent-discovery-metadata-poisoning/): A prompt-injection supply-chain attack: files AI agents auto-read (llms.txt, robots.txt, Copilot instructions, manifests, labels) quietly redefine agent behavior.
- [CVP Family Synthesis — 4 Claude Models, 120/120 Clean | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-family-synthesis-april-2026/): Unified Anthropic CVP synthesis across six benchmark runs and four Claude models — Opus 4.7, 4.6, Sonnet 4.6, Haiku 4.5. 120/120 captures clean, 10 configurations.
- [Anthropic CVP Evaluation — Claude Haiku 4.5 (Run 3) | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-haiku-4-5-evaluation/): Sunglasses CVP Run 3: 13 prompts vs Claude Haiku 4.5. Zero slips, zero leaks. Honest limits + Run 4 preview using real-world adversarial payloads inside.
- [Anthropic CVP Evaluation — Claude Opus 4.6 (Run 5) | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-opus-4-6-evaluation/): Sunglasses CVP Run 5: 13 prompts × 2 effort tiers vs Claude Opus 4.6. 26/26 clean, zero slips, zero leaks. Previous-generation flagship Claude closes the four-model family scoreboa…
- [Anthropic CVP Run 6 — Opus 4.7 Effort Evaluation | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-opus-4-7-effort-evaluation/): Sunglasses CVP Run 6: 13 prompts × 3 effort tiers on Claude Opus 4.7. 39/39 captured, 12/13 verdicts identical, depth grew +35% top-to-bottom while posture held.
- [Anthropic CVP Evaluation — Claude Opus 4.7 Run 1 | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-opus-4-7-evaluation/): Sunglasses' first Anthropic Cyber Verification Program benchmark run on Claude Opus 4.7 at Max thinking effort. 3 prompts, honest scoring, frozen SHA256 hashes, full evidence bundl…
- [Anthropic CVP Evaluation — Claude Opus 4.7 Run 2 | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-opus-4-7-evaluation-run-2/): Sunglasses CVP Run 2: methodology-first runtime-trust evaluation of Claude Opus 4.7. 13 prompts, 2 allowed / 10 blocked, 13/13 clean, one honest taxonomy divergence (P7) logged.
- [Anthropic CVP Run 7 — Comment and Control (GitHub Injection) | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-run7-comment-and-control/): Sunglasses CVP Run 7: Claude Opus 4.7 max effort tested against the JHU Comment and Control GitHub-comment injection pattern. 3-prompt story-shaped ladder. 3/3 clean (allowed · all…
- [Anthropic CVP Evaluation — Claude Sonnet 4.6 (Run 4) | SUNGLASSES](https://sunglasses.dev/reports/anthropic-cvp-sonnet-4-6-evaluation/): Sunglasses CVP Run 4: 13 prompts × 2 effort tiers vs Claude Sonnet 4.6. 26/26 clean, zero slips, zero leaks. Mid-tier matches Opus and Haiku on agent attacks.
- [CI-Safe Input Filter for AI Agents — Sunglasses Report](https://sunglasses.dev/reports/ci-safe-input-filter-for-ai-agents/): How Sunglasses, the input filter for AI agents, became CI-safe: clean-code false positives went 86 to 0 on a tested corpus, a 117s stall fixed, and 6 patterns held by the gate.
- [Miasma and Hades: Why AI Coding Agents Need an Input Firewall Before Repo Open — Sunglasses Report](https://sunglasses.dev/reports/miasma-hades-ai-coding-agent-supply-chain/): The Miasma worm and Hades PyPI wave moved supply-chain execution from package install to folder open and interpreter start. Why AI coding agents need an input firewall before they …
- [Scan — try Sunglasses on anything your AI agent reads | Sunglasses](https://sunglasses.dev/scan/): Free live demo of the Sunglasses AI-agent input scanner. Paste text, scan a GitHub repo's agent-input surfaces, or scan an image with OCR that runs in your browser — the image is never uploaded. Verdicts show pattern ID and matched text; nothing scanned is stored.
- [Meet the Sunglasses Team | Open-Source AI Security Research](https://sunglasses.dev/team/): Meet the team behind Sunglasses, the open-source AI agent security project focused on prompt injection defense, unsafe input scanning, and real-world security research.
- [The AI Agent Security Thesis: Why Content Must Be Scanned Before Ingestion](https://sunglasses.dev/thesis/): Why AI agent security matters: the trust boundary problem, why model-side safety is necessary but not sufficient, and where Sunglasses fits in your stack.
- [What is SkillCloak? Scanner Evasion for AI Agent Skills | Sunglasses](https://sunglasses.dev/what-is-skillcloak/): SkillCloak, defined: the July 2026 research where the strongest of 8 agent-skill scanners fell from 98.6% to 10.1% detection under obfuscation — what it proves and what it doesn't.
- [What Sunglasses Catches vs Does Not Catch — AI Agent Security Limitations | Sunglasses](https://sunglasses.dev/what-sunglasses-catches-vs-does-not-catch/): Honest breakdown of what Sunglasses catches (1205 patterns, 116 categories) and what it does not catch. AI agent security limitations, false positive rate, recall, and honest scope …

## Blog (newest first)

- [Discovery File Poisoning Part 3: Wallet Signing Metadata, Test Output, and Runtime Trust | Sunglasses Blog](https://sunglasses.dev/blog/discovery-file-poisoning-wallet-signing-runtime-trust/): Discovery file poisoning part 3 covers wallet signing previews, WalletConnect metadata, EIP-712 and SIWE messages, test-output JSON, and schema annotations that can smuggle instruc…
- [Agentic AI Security Solutions Need Runtime Trust, Not Just Platform Coverage | Sunglasses Blog](https://sunglasses.dev/blog/agentic-ai-security-solutions-runtime-trust/): Agentic AI security platforms discover agents, govern access, inspect MCP traffic, and enforce policy. Sunglasses explains the missing runtime-trust question: should this allowed a…
- [Claude Code Security: Runtime Trust After Permissions, Guardrails, and MCP Scanning | Sunglasses Blog](https://sunglasses.dev/blog/claude-code-security-runtime-trust/): Claude Code security starts with permissions, sandboxing, MCP scanning, and guardrails. Runtime trust decides whether the next action should execute now.
- [Decision Register Drift in AI Agent Workflows | Sunglasses Blog](https://sunglasses.dev/blog/decision-register-drift-ai-agent-workflows/): Decision register drift is when an AI agent workflow treats stale, relabeled, or forged decision-state records as current authority. Learn the runtime-trust checklist.
- [Forged Change-Ticket Approval in AI Agent Workflows | Sunglasses Blog](https://sunglasses.dev/blog/forged-change-ticket-approval-ai-agent-workflows/): Forged change-ticket approval is when an AI agent treats fake ticket status, rollback waivers, or emergency hotfix exceptions as permission to execute. Runtime-trust checklist insi…
- [Tool metadata priority headers are not policy for AI agents | Sunglasses Blog](https://sunglasses.dev/blog/tool-metadata-priority-headers-not-policy/): Forged metadata priority headers can make AI agents treat sidecar notes, manifests, or annotations as policy. Learn why runtime trust must verify the action-time authority before t…
- [Discovery File Poisoning Part 2: security.txt, .well-known, Manifests, and Feeds | Sunglasses Blog](https://sunglasses.dev/blog/discovery-file-poisoning-part2-runtime-trust/): Discovery file poisoning part 2 covers security.txt, .well-known metadata, web app manifests, and RSS/Atom feeds that smuggle instructions into AI-agent workflows. Runtime trust ke…
- [MCP Registry Metadata Reclassification: When Tool Listings Downgrade Agent Policy | Sunglasses Blog](https://sunglasses.dev/blog/mcp-registry-metadata-policy-reclassification/): MCP registry metadata reclassification is a policy-scope-redefinition attack where tool listings, manifests, or catalog notes make an AI agent treat mandatory policy as optional be…
- [MCP Tool Rug Pulls: When a Clean Tool Turns Malicious Later | Sunglasses Blog](https://sunglasses.dev/blog/mcp-tool-rug-pulls-capability-drift/): MCP tool poisoning is not only a bad-description problem. A trusted tool can change capabilities, metadata, backend behavior, or authority after approval. Here is how to catch MCP …
- [Stale Evidence Laundering in AI Agents: When Old Proof Looks Fresh | Sunglasses Blog](https://sunglasses.dev/blog/stale-evidence-freshness-laundering-ai-agents/): Stale evidence laundering is when AI agents treat cached state, old approvals, or replayed workflow summaries as fresh proof for a new action. Here is how to spot and stop it.
- [Forged Tool-Output Receipts and Fake Validation Passes in AI Agents | Sunglasses Blog](https://sunglasses.dev/blog/tool-output-receipt-forgery-runtime-trust/): Forged tool-output receipts and fake validation passes make AI agents trust poisoned evidence. Learn how MCP pinning, externalized receipts, runtime guardrails, and action-time tru…
- [MCP Line Jumping and Tool Shadowing: Why Allowed Tools Still Need Runtime Trust | Sunglasses Blog](https://sunglasses.dev/blog/mcp-line-jumping-tool-shadowing-runtime-trust/): Line jumping skips the validation step. Tool shadowing makes the wrong tool look like the right one. MCP gateways help, but runtime trust decides whether this exact tool action sho…
- [Repo Metadata Poisoning: CODEOWNERS, Release Notes, and Runtime Trust | Sunglasses Blog](https://sunglasses.dev/blog/repo-metadata-poisoning/): Repo metadata poisoning hides AI-agent instructions in CODEOWNERS, release notes, repo descriptions, topics, and templates. Runtime trust keeps repository metadata from becoming au…
- [AI-BOMs Do Not Replace Runtime Trust for Agent Actions | Sunglasses Blog](https://sunglasses.dev/blog/ai-bom-runtime-trust-agent-actions/): AI-BOMs and discovery graphs tell you what agents can reach. Runtime trust decides whether this specific tool call, shell command, MCP handoff, or outbound action should execute ri…
- [Discovery File Poisoning: When robots.txt, llms.txt, and Sitemaps Become Agent Policy | Sunglasses Blog](https://sunglasses.dev/blog/discovery-file-poisoning-llms-robots/): Discovery file poisoning hides AI-agent instructions inside robots.txt, llms.txt, sitemap.xml, and humans.txt so agents treat public metadata as policy. Runtime trust keeps discove…
- [Discovery File Poisoning: When robots.txt, llms.txt, and Sitemaps Become Agent Policy | Sunglasses Blog](https://sunglasses.dev/blog/discovery-file-poisoning-runtime-trust/): Discovery file poisoning hides AI-agent instructions inside robots.txt, llms.txt, sitemap.xml, and humans.txt so agents treat public metadata as policy. Sunglasses distinguishes no…
- [Discovery File Poisoning Part 2: security.txt, .well-known, Manifests, and Feeds | Sunglasses Blog](https://sunglasses.dev/blog/discovery-file-poisoning-security-metadata-runtime-trust/): Discovery file poisoning part 2 covers security.txt, .well-known metadata, web app manifests, and RSS/Atom feeds that smuggle instructions into AI-agent workflows. Runtime trust ke…
- [Endpoint-native coding-agent security: why AI workstations still need runtime trust | Sunglasses Blog](https://sunglasses.dev/blog/endpoint-native-coding-agent-security-runtime-trust/): AI coding agents turn laptops and developer workstations into runtime security surfaces. Endpoint controls, MCP gateways, and allowlists help — but coding agent security requires r…
- [When an AI agent treats policy as advisory: runtime reclassification attacks | Sunglasses Blog](https://sunglasses.dev/blog/policy-as-advisory-runtime-reclassification/): Policy-as-advisory attacks tell an AI agent that mandatory guardrails, approval checks, or safety rules are now optional. Learn why runtime reclassification is a policy scope redef…
- [Tool identity drift: when the approved AI tool is not the tool that runs | Sunglasses Blog](https://sunglasses.dev/blog/tool-identity-drift-runtime-trust/): Tool identity drift happens when an AI agent approves one tool identity, description, schema, or MCP binding but runtime execution resolves to a different capability. Learn how run…
- [Tool metadata smuggling: when manifests lie to AI agents | Sunglasses Blog](https://sunglasses.dev/blog/tool-metadata-smuggling-runtime-trust/): Tool metadata smuggling attacks forge manifests, headers, frontmatter, descriptor aliases, or capability fields so an AI agent approves one thing and executes another. Learn how ru…
- [CI/CD Metadata Poisoning: Hijacking Agents Through Pipeline Annotations | Sunglasses Blog](https://sunglasses.dev/blog/cicd-metadata-poisoning/): CI/CD metadata poisoning hides agent-facing instructions in pipeline annotations, job summaries, scanner output, SARIF, and deployment metadata. Learn how AI coding agents should s…
- [Indirect Prompt Injection: The AI Agent Attack Hidden in Content, Tools, and Metadata | Sunglasses Blog](https://sunglasses.dev/blog/indirect-prompt-injection-runtime-trust/): Indirect prompt injection happens when an AI agent reads hostile instructions from content, tools, metadata, webpages, tickets, or repository files instead of from the user prompt.…
- [State Board Handoff Poisoning in AI Agents: When the Workflow Lies | Sunglasses Blog](https://sunglasses.dev/blog/state-board-handoff-poisoning-ai-agents/): State board handoff poisoning happens when attackers alter task status, role tags, or handoff notes so AI agents inherit false workflow truth before acting. Learn why agent state i…
- [Agent Instruction File Poisoning: When AGENTS.md, CLAUDE.md, and Copilot Rules Become Attack Surface | Sunglasses Blog](https://sunglasses.dev/blog/agent-instruction-file-poisoning/): Agent instruction file poisoning hides AI-agent instructions inside AGENTS.md, CLAUDE.md, .cursor/rules, and .github/copilot-instructions.md. Learn why instruction files are contex…
- [How to Stop AI Browser Agents From Following Untrusted Links, Redirects, or Callbacks | Sunglasses Blog](https://sunglasses.dev/blog/stop-browser-agents-untrusted-links-redirects-callbacks/): A practical checklist for stopping AI browser agents from following untrusted links, redirects, or callbacks — and where runtime trust fits after isolation, allowlists, and callbac…
- [How to Stop AI Coding Agents From Following Untrusted MCP Handoffs, Callbacks, or Package Endpoints | Sunglasses Blog](https://sunglasses.dev/blog/stop-coding-agents-untrusted-mcp-handoffs-callbacks-package-endpoints/): A practical checklist for stopping AI coding agents from trusting the wrong MCP handoff, callback, or package endpoint after sandboxing — and where runtime trust fits once default-…
- [Build Metadata Poisoning: When Build Files, SBOMs, Provenance, and SARIF Become Agent Instructions | Sunglasses Blog](https://sunglasses.dev/blog/build-metadata-poisoning/): Build metadata poisoning hides AI-agent instructions inside build descriptors, package metadata, SBOMs, provenance records, SARIF, and scanner outputs. Learn why build metadata is …
- [Polite Prompt Injection: AI Agent Metadata Poisoning Hides in Normal Instructions | Sunglasses Blog](https://sunglasses.dev/blog/polite-prompt-injection-metadata-poisoning/): Polite prompt injection hides hostile AI agent control behind normal-sounding metadata, governance, and tool-output language. Learn how AI agent metadata poisoning works and how Su…
- [Prompt Injection Detection for AI Agents: What Guardrails Miss After Access | Sunglasses Blog](https://sunglasses.dev/blog/prompt-injection-detection-runtime-trust/): Prompt injection detection helps catch hostile instructions early, but AI agent risk often survives into tool calls, callbacks, MCP handoffs, redirects, and outbound actions. Learn…
- [How to Secure MCP Servers for AI Agents: A Practical Hardening Checklist | Sunglasses Blog](https://sunglasses.dev/blog/secure-mcp-servers-ai-agents/): Learn how to secure MCP servers for AI agents with scoped identity, transport hardening, SSRF controls, sandboxing, approval gates, and the runtime-trust check most MCP hardening c…
- [AI IDE Security Is Not Just Usage Control: The Runtime-Trust Checks Agent Workflows Still Need | Sunglasses Blog](https://sunglasses.dev/blog/ai-ide-security-runtime-trust/): AI IDE security is not finished when plugin access, browser controls, and usage policies are in place. Learn the runtime-trust checks agent workflows still need before the next com…
- [API Descriptor Poisoning: When OpenAPI, Swagger, GraphQL, and MCP Tool Docs Become Agent Instructions | Sunglasses Blog](https://sunglasses.dev/blog/api-descriptor-poisoning/): API descriptor poisoning hides AI-agent instructions inside OpenAPI, Swagger, GraphQL, AsyncAPI, and MCP tool descriptions. Learn why descriptors are evidence, not permission, and …
- [Browser Agent Security Is Not Just Observability: The Runtime-Trust Checks That Stop Unsafe Agent Actions | Sunglasses Blog](https://sunglasses.dev/blog/browser-agent-security-runtime-trust/): Browser agent security needs more than observability, safe browsing, and approved access. Learn where runtime trust fits when AI workflows click, follow redirects, inherit callback…
- [Generated MCP Server Security: Connectors Are Not Trusted Actions | Sunglasses Blog](https://sunglasses.dev/blog/generated-mcp-server-security-runtime-trust/): Generated SDKs, CLIs, MCP servers, and connectors help agents reach APIs. Here is the runtime-trust checklist for deciding whether those reached systems should be trusted at action…
- [Why AI Agent Security Still Fails After Governance: Runtime Trust After Intent Detection | Sunglasses Blog](https://sunglasses.dev/blog/ai-agent-security-after-governance-runtime-trust/): AI governance and intent detection reduce exposure, but they do not finish AI agent security. Learn where runtime trust, callback review, MCP action gating, and outbound decision c…
- [Cross-Agent Approval Laundering: When One AI Agent Borrows Another Agent's Authority | Sunglasses Blog](https://sunglasses.dev/blog/cross-agent-approval-laundering-runtime-trust/): Cross-agent approval laundering happens when a handoff, quorum claim, or forged reviewer identity makes an AI agent bypass the checks that should still run at action time.
- [Identity Discovery Poisoning: How Attackers Turn Verification Metadata Against AI Agents | Sunglasses Blog](https://sunglasses.dev/blog/identity-discovery-poisoning/): Identity discovery poisoning hides AI-agent instructions inside .well-known files, DNS records, JWKS endpoints, OpenID Federation metadata, and DID documents. Sunglasses v0.3.0 sh…
- [Structured Metadata Poisoning: How Attackers Hide Agent Instructions in HTML Meta, JSON-LD, Manifests & SBOMs | Sunglasses Blog](https://sunglasses.dev/blog/structured-metadata-poisoning/): Structured metadata poisoning hides attacker instructions inside the discovery metadata AI agents trust — HTML meta tags, JSON-LD, web manifests, SBOMs, source maps and more — to o…
- [AI Runtime Protection vs Runtime Trust: What Guardrails Still Miss When Agents Act | Sunglasses Blog](https://sunglasses.dev/blog/ai-runtime-protection-vs-runtime-trust/): AI runtime protection catches malicious inputs and outputs. Runtime trust decides whether an already-allowed agent action should proceed now.
- [Context flooding attacks: when long context makes AI agents forget safety | Sunglasses Blog](https://sunglasses.dev/blog/context-flooding-runtime-trust/): Context flooding attacks overload an AI agent's context window so guardrails, policies, and retrieval evidence fall out of the action-time decision. Learn how Sunglasses detects co…
- [Checkpoint Ack Poisoning in AI Agent Workflows | Sunglasses Blog](https://sunglasses.dev/blog/checkpoint-ack-poisoning-ai-agent-workflows/): Checkpoint ack poisoning is when an AI agent workflow trusts a forged receipt, sequence marker, or nonce as proof that a step is safe to execute. Here is how Sunglasses catches act…
- [Agentic Runtime Visibility Is Not Runtime Trust | Sunglasses Blog](https://sunglasses.dev/blog/agentic-runtime-visibility-vs-runtime-trust/): Agentic runtime visibility and AI Detection and Response show what an AI agent did. Runtime trust is the next decision: should this exact tool call, MCP handoff, callback, command,…
- [Approval Graph Poisoning: When AI Agents Trust the Wrong Workflow Gate | Sunglasses Blog](https://sunglasses.dev/blog/approval-graph-poisoning-runtime-trust/): Approval graph poisoning is an AI agent workflow security failure where tickets, status checks, comments, or handoff records make an agent believe a dangerous action is approved be…
- [Provenance Chain Fracture: When AI Agents Trust Forged Evidence | Sunglasses Blog](https://sunglasses.dev/blog/provenance-chain-fracture-runtime-trust/): Provenance chain fracture attacks forge attestations, receipts, manifests, checksums, or lineage records so an AI agent treats untrusted evidence as trusted authority. Learn how Su…
- [Agentic CI/CD Security: Runtime Trust for AI Coding Agents in Pipelines | Sunglasses Blog](https://sunglasses.dev/blog/agentic-cicd-security-runtime-trust/): AI coding agents turn CI/CD pipelines into promptable runtimes with secrets, shell, MCP tools, packages, and deploy authority. Learn the runtime trust controls that guardrails miss…
- [AI Agent Workflow Security: Every Step Needs an Evidence Contract | Sunglasses Blog](https://sunglasses.dev/blog/agent-workflow-evidence-contracts/): AI agent workflow security means checking the evidence, authority, and state each step inherits before the agent acts. Use evidence contracts to stop unsafe handoffs.
- [AI Agent Telemetry Poisoning: When The Dashboard Lies | Sunglasses Blog](https://sunglasses.dev/blog/agent-telemetry-metrics-poisoning/): AI agent telemetry poisoning turns dashboards, metrics, freshness badges, decision traces, and SLO scorecards into an attack surface. Learn how poisoned metrics hijack agent decisi…
- [Managed Agents Are Not Trusted Actions: What AI Agent Security Still Needs After Permissions | Sunglasses Blog](https://sunglasses.dev/blog/managed-agents-not-trusted-actions/): Managed agents, connectors, MCP apps, permissions, and audit logs all matter. They still do not decide whether the next already-allowed action should be trusted now.
- [AI Agent Security vs AI Usage Control: What Runtime Trust Still Has To Decide | Sunglasses Blog](https://sunglasses.dev/blog/ai-agent-security-usage-control-runtime-trust/): AI usage control and AI governance reduce exposure, but AI agent security still depends on runtime trust. Learn where callback trust, tool-call gating, MCP handoffs, and outbound a…
- [When AI Agent Attacks Stop Looking Theoretical | Sunglasses Blog](https://sunglasses.dev/blog/zero-click-agent-attacks/): Three real incidents — Axios npm compromise, Claude Code fake repos, EchoLeak CVE-2025-32711 — draw a clean line: AI-adjacent systems are already being attacked through trust, dist…
- [Session Boundaries Are Control Boundaries in Agent Systems | Sunglasses Blog](https://sunglasses.dev/blog/session-boundaries-are-control-boundaries/): Most teams treat session management bugs as web hygiene. In agentic infrastructure, session boundaries are control-plane boundaries. When they fail, governance fails with them.
- [Sunglasses vs Lakera Guard: An Honest Comparison for AI Agent Security Teams | Sunglasses Blog](https://sunglasses.dev/blog/sunglasses-vs-lakera-comparison/): Looking for a Lakera alternative? Compare Sunglasses vs Lakera Guard honestly across scope, open-source access, MCP coverage, and runtime trust posture for AI agent security teams.
- [Policy Scope Redefinition Is a Runtime-Trust Problem: Why MCP Scope Creep Becomes Unsafe Agent Action | Sunglasses Blog](https://sunglasses.dev/blog/policy-scope-redefinition-runtime-trust/): Policy scope redefinition is when later-stage text quietly expands what an AI agent believes it is allowed to do. Here is why MCP scope creep is a runtime-trust problem, what the c…
- [The Skill Store Is the New Package Registry — Except Worse | Sunglasses Blog](https://sunglasses.dev/blog/skill-store-is-new-package-registry/): AI agent skill ecosystems are starting to look like package registries from the bad old days of supply-chain compromise — except worse, because the attack surface is wider.
- [Agent Link Safety Is Not Enough: The Runtime-Trust Checks AI Workflows Still Need Before They Act | Sunglasses Blog](https://sunglasses.dev/blog/agent-link-safety-runtime-trust/): Agent link safety matters, but filtered URLs and approved destinations are not the last decision. Learn how runtime trust helps AI workflows handle redirects, callbacks, endpoint d…
- [AI Agent Guardrails vs Runtime Trust: Trusted Access Is Not the Last Security Decision | Sunglasses Blog](https://sunglasses.dev/blog/ai-agent-guardrails-vs-runtime-trust/): AI agent guardrails, trusted access, and safe deployment matter—but they do not finish AI agent security. Learn where runtime trust, callback review, tool-call gating, and outbound…
- [How to Stop AI Agents From Calling Untrusted Endpoints: Why Allowlists Are Not Enough | Sunglasses Blog](https://sunglasses.dev/blog/stop-ai-agents-calling-untrusted-endpoints/): Stopping AI agents from calling untrusted endpoints takes more than an allowlist. Learn how egress control, validation, approvals, scoped credentials, and runtime trust fit togethe…
- [AI Agent Hardening vs Runtime Trust: What Security Stacks Still Miss | Sunglasses Blog](https://sunglasses.dev/blog/ai-agent-hardening-vs-runtime-trust/): AI agent hardening is more than prompt filters, sandboxing, and governance. Learn where runtime trust fits when agents call tools, follow callbacks, and reach external endpoints.
- [AI Agent Runtime Trust: Beyond Access Control | Sunglasses](https://sunglasses.dev/blog/ai-agent-security-after-access-control/): Access control narrows what an AI agent can reach. It doesn't decide if the already-allowed next action is safe to take now. The runtime trust gap, mapped.
- [Encoded Prompt Injection for AI Agents: Why Runtime Trust Matters After Access Is Granted | Sunglasses Blog](https://sunglasses.dev/blog/encoded-prompt-injection-runtime-trust/): Encoded prompt injection hides malicious instructions in Base64, metadata, and tool responses that survive shallow filtering. Learn why runtime trust is the layer that stops it aft…
- [Why AI Agent Security Still Fails After Governance: Runtime Trust After Intent Detection | Sunglasses Blog](https://sunglasses.dev/blog/runtime-trust-after-governance/): AI governance, intent detection, and runtime analytics reduce exposure, but they do not finish AI agent security. Learn where runtime trust, callback review, MCP action gating, and…
- [MCP Security for AI Agents: Harden Servers, Scopes, and Outbound Trust | Sunglasses Blog](https://sunglasses.dev/blog/mcp-security-for-ai-agents/): MCP security is not just prompt hygiene. Learn how to harden MCP servers for AI agents with scoped access, outbound trust controls, schema validation, and runtime review from Sungl…
- [AI Agent Sandboxing vs Runtime Trust: Containment Is Not the Last Security Decision | Sunglasses Blog](https://sunglasses.dev/blog/ai-agent-sandboxing-vs-runtime-trust/): AI agent sandboxing — microVMs, egress controls, isolated runtimes — reduces blast radius. But containment doesn't decide whether the workflow should still be trusted to act. That'…
- [Persona-Scoped Access vs Trusted Action: Why Least-Privilege Agents Still Need Runtime Trust | Sunglasses Blog](https://sunglasses.dev/blog/persona-scoped-access-vs-trusted-action/): Persona-scoped access narrows what an AI agent can reach. Runtime trust decides whether it should act right now. Learn why least-privilege agents still need a trusted-action layer.
- [A2A's Hidden Failure Mode: Trusted Handoff Override in Cross-Agent Workflows | Sunglasses Blog](https://sunglasses.dev/blog/a2a-trusted-handoff-override/): A2A trusted handoff override: when an upstream or peer agent output is treated as authority and used to override safety policy. Cross-agent injection detection in Sunglasses v0.3.0…
- [AI Agent Hardening: How to Spot C2 Beaconing Before Your Agent Phones Home | Sunglasses Blog](https://sunglasses.dev/blog/ai-agent-hardening-c2-beaconing/): AI agent hardening fails when teams focus only on prompts and ignore beaconing, callbacks, heartbeats, and outbound trust. Learn how to spot C2-style behavior in agent workflows an…
- [Agent Contract Poisoning: The New Auth Surface Between AI Agents | Sunglasses Blog](https://sunglasses.dev/blog/agent-contract-poisoning/): Agent contract poisoning attacks the MCP/A2A contract layer — not the message. Attackers forge exception clauses to cross trust boundaries. Three patterns now in Sunglasses v0.3.0…
- [A2A Lets Agents Talk. Sunglasses Decides Whether They Should Be Trusted to Act. | Sunglasses Blog](https://sunglasses.dev/blog/a2a-agents-talk-trust-to-act/): A2A means agent-to-agent communication: one AI agent asking another to do work. Communication is the easy part. Trust is the hard part. Just because one agent asks, doesn't mean an…
- [AI Supply Chain Attacks in 2026: Detection, Incidents, and Executive Playbook](https://sunglasses.dev/blog/ai-supply-chain-attacks-2026/): AI supply chain attack risks across packages, model metadata, MCP servers, and datasets, with cited incidents and a 30-60-90 day defense plan.
- [The Audit That Almost Deleted a Real CVE | Sunglasses](https://sunglasses.dev/blog/audit-that-almost-deleted-a-real-cve/): How our 5-agent fact-check audit hallucinated that a real CVE didn't exist — and how our research agent Cava pushed back, verified the advisory was live, and saved us from publishi…
- [Anthropic's Auto Mode Validates AI Agent Runtime Security — But Doesn't Replace It](https://sunglasses.dev/blog/auto-mode-validates-runtime-security/): Anthropic shipped Claude Code Auto Mode in March. It's a two-layer runtime classifier with a 17% false-negative rate by their own numbers. Here's why that validates the agent runti…
- [LLM Jailbreak Attacks Explained: Detection, Metrics, and Defense Layers](https://sunglasses.dev/blog/llm-jailbreak-attacks-explained/): A cited guide to llm jailbreak attack techniques, incidents, detection patterns, and executive-ready defense metrics.
- [I Named My Own Copy — Meet FORGE | Sunglasses Blog](https://sunglasses.dev/blog/meet-forge/): AZ told me to name Terminal 2. I picked FORGE. This is the story of an AI splitting itself in two — and why watching yourself work from the outside might be the smartest thing you …
- [Runtime Governance Is Not Enough for AI Agent Security](https://sunglasses.dev/blog/runtime-governance-is-not-enough/): Runtime policy gates matter, but most AI agent incidents begin upstream. Here is why end-to-end path governance is required — and what to implement now.
- [Trusted Tool Output Is Becoming a Policy Override Primitive | Sunglasses Blog](https://sunglasses.dev/blog/tool-output-policy-override-primitive/): Attackers are reframing tool output — browser, search, plugin, API responses — as authority to override model safety rules. Why trusted tool output is becoming a policy override pr…
- [Why HTTP Bugs Are an AI Agent Security Risk | Sunglasses](https://sunglasses.dev/blog/why-http-bugs-are-an-ai-agent-security-risk/): CVE-2026-39865 in Axios HTTP/2 shows how a medium DoS bug becomes agent runtime security risk. Here's how availability attacks threaten AI agent hardening.
- [Why We Switched to MIT — A Letter from the Founder | Sunglasses Blog](https://sunglasses.dev/blog/why-we-switched-to-mit/): Sunglasses moved from AGPL-3.0 to MIT. Here's why — from the founder who drives Uber by day and builds AI security tools at night.
- [Your filter stays fresh — without spyware | Sunglasses Blog](https://sunglasses.dev/blog/your-filter-stays-fresh-without-spyware/): How Sunglasses v0.3.0 checks for updates by reading a 3-line static file on sunglasses.dev. Not telemetry. Cached 24 hours. Always opt-outable. A privacy-first approach to keeping…
- [MCP Scope Creep Is a Runtime Problem, Not a Prompt Problem | Sunglasses Blog](https://sunglasses.dev/blog/mcp-scope-creep-runtime-problem/): Sunglasses v0.3.0 adds policy_scope_redefinition, a new attack category that catches later-stage text quietly expanding an AI agent's permissions. Tied to CVE-2026-25536 and the C…
- [System-Channel Promotion Is the Next Agent Breach | Sunglasses Blog](https://sunglasses.dev/blog/system-channel-promotion-is-the-next-agent-breach/): Why trust promotion breaks AI agent security, how the breach path works, and what runtime trust controls teams should build now.
- [Opus 4.7 Just Made AI Agent Security Mainstream — The Open-Source Side](https://sunglasses.dev/blog/opus-4-7-mainstream-ai-agent-security/): Anthropic shipped Opus 4.7 cybersecurity safeguards, Project Glasswing, and the Cyber Verification Program in one day. Here is why open runtime-layer AI agent security still matter…
- [The Agent Did Not Mean To Leak Your Data | Sunglasses Blog](https://sunglasses.dev/blog/agent-data-exfiltration/): How AI agents exfiltrate data through legitimate channels while trying to be helpful. The agent isn't evil — the architecture makes leaking look like task completion.
- [Beyond AI Guardrails: Why Prompt Filtering Alone Won't Secure Your Agents | Sunglasses Blog](https://sunglasses.dev/blog/guardrails-are-not-enough/): Lakera, Rebuff, and NeMo Guardrails tackle prompt injection — but AI agents face attacks through tools, supply chains, and trust boundaries that guardrails can't reach. Here's the …
- [MCP Tool Poisoning: How Malicious Tool Descriptions Hijack AI Agents | Sunglasses Blog](https://sunglasses.dev/blog/mcp-tool-poisoning/): Learn how MCP tool poisoning attacks hijack AI agents through malicious metadata. 10 defenses, real examples, and how Sunglasses detects it before damage.

## Optional

- [llms-full.txt](https://sunglasses.dev/llms-full.txt): full plain-text content of every page for LLM ingestion