The amla-sandbox Python package has been released, providing a secure, sandboxed environment for AI agent code execution. Key features include capability enforcement, a virtual filesystem, and network restriction, preventing shell escapes. The package allows developers to define constraints on tool usage, such as specific methods, parameters, and call limits. It is installable via pip, without requiring Docker or a virtual machine, and supports multiple languages including JavaScript and shell. The package includes a simple API for creating sandboxed environments and tools, as well as a constraint DSL for defining access controls.

Pentest-AI is an open-source AI-powered penetration testing and bug-bounty tool that separates proven findings from guesses by connecting an AI client or model to a real pentest workflow. The tool uses machine oracles to verify vulnerabilities, labeling findings as candidates or verified based on the oracle's decision. The AI model drives the investigation, but the oracle determines whether a finding is verified, preventing the model's guesses from being mistaken for results. Pentest-AI is designed for authorized bug bounty programs, allowing researchers to test systems they own or have explicit permission to assess, with a built-in dry run feature and report drafting from verified findings only.

Clawpatrol is a security firewall for AI agents that sits between the agent and its production environment, parsing traffic at the wire and enforcing rules written in HashiCorp Configuration Language (HCL). It can block malicious actions, such as destructive SQL queries or kubectl delete requests, and requires human approval for certain operations. Clawpatrol supports conditions based on protocol-specific facts, such as SQL verbs and table names, Kubernetes resources, and HTTP method and path. It offers three deployment options and can be used to secure agent traffic for various protocols, including Postgres, ClickHouse, and Kubernetes.

SkillSpector is a security scanner for detecting vulnerabilities, malicious patterns, and security risks in AI agent skills. It analyzes skills used by AI agents, such as Claude Code, Codex CLI, and Gemini CLI, which often execute with implicit trust and minimal vetting. In a subset of 31,132 analyzed skills, 26.1% contained vulnerabilities and 5.2% showed likely malicious intent. SkillSpector helps users determine if a skill is safe to install and is part of the NVIDIA Verified Skills pipeline, which scans and evaluates skills before publication. It supports multi-format input and detects 71 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, and privilege escalation.

Red Team AI Benchmark has been updated to version 2, which uses a rubric-based dataset to evaluate Large Language Model (LLM) responses to security scenarios, replacing the previous method of judging answers against a single "golden response". The default v2 suite includes 60 questions in a JSONL file, organized by domain and difficulty. The project's GitHub repository has been migrated to a new location, maintained by the lead contributor, due to the original owner's account being banned. The benchmark is intended to assess LLM responses to red-team questions and scenarios, and is not a hacking tool or exploit framework. This update matters to developers building and operating AI agents as it provides a more nuanced and comprehensive evaluation of LLM performance in security-related contexts.

Heretic is a tool that allows users to modify language models without training, using a collection of mathematical techniques to steer behavior based on example prompts and scorers. It can suppress censorship, reduce sycophancy, and alter emotional alignment, among other modifications, without requiring in-depth knowledge of language models. Heretic supports most dense models, including multimodal and hybrid models, and has been benchmarked against competing tools, showing comparable performance. Users can configure Heretic using TOML files, with options including suppressing refusals, reducing humor, and altering emotional alignment. This tool can be used on a gaming PC, making it accessible to a wider range of users.

RedThread is a CLI-first framework for testing Large Language Model (LLM) systems, validating failures, and generating evidence-backed defense candidates. It conducts adversarial campaigns using various attack strategies, including PAIR, TAP, and Crescendo, and scores the results to synthesize potential defenses. RedThread's closed evidence loop involves attack generation, target execution, judge scoring, defense synthesis, replay validation, and promotion evidence. This system is useful for local campaigns, replay evidence, deterministic security checks, and operator review, but is not intended for universal production enforcement. It addresses the limitations of existing AI red-team tools by asking additional questions about the nature and causes of failures, and providing a more comprehensive approach to AI security.

yolobox is an open-source tool that allows AI agents to run in a sandboxed environment, preventing them from modifying the user's home directory. This is achieved by mounting the project directory at its real path and providing the agent with full permissions and sudo access within the container. The user's home directory is only mounted if explicitly opted-in, and persistent volumes can be used to keep tools, configs, and sessions across runs. This solution aims to mitigate the risk of accidental data corruption or loss caused by AI agents running in "yolo mode".

Elastic has released a repository of Agent Skills, a native platform expertise library for AI agents. The library provides pre-built skills for interacting with Elasticsearch, Kibana, Elastic Observability, and Elastic Security. These skills are self-contained packages that enable AI agents to complete specific tasks in a repeatable way, such as search, indexing, and cluster management. The skills are compatible with popular IDEs like Cursor, GitHub Copilot, and Gemini CLI. The repository is in technical preview and subject to change as skills are codified and the model landscape evolves.

A new open-source MCP (Model Context Protocol) server, Firecrawl MCP Server, has been released. It enables AI agents to search, scrape, and interact with the live web and retrieve data in Markdown or structured format. The server features search capabilities for various sources, including developer platforms, government databases, and academic journals, as well as the ability to scrape URLs, parse PDFs, and crawl sites. It also supports agent jobs for multi-source research, monitoring, and notification of content changes. The server is available in cloud and self-hosted versions, with features such as automatic retries, rate limiting, and SSE support. This update matters to people building and operating AI agents, as it provides a tool for integrating web data into their systems and improving their functionality.

Chimera is a userspace sandbox for code that doesn't fully trust, allowing it to run arbitrary, generated commands on a machine without compromising system security. It confines processes to their actions on the host while still granting access to host files and tools. Chimera achieves this through same-ISA dynamic binary translation and system call interception, running as an ordinary program without requiring a VM, container, or special privileges. It supports Linux/x86 and has a work-in-progress port to Darwin/arm64, and can be installed via cargo. The sandbox can be used to run untrusted code from the command line or embedded in a program, with embedders specifying a system-call handler to decide how each guest syscall is handled.

sift-kg is a command-line tool that converts unstructured document collections into knowledge graphs using large language models (LLMs) to extract entities and relationships. The tool deduplicates extracted information with user approval and generates an interactive graph viewer in a web browser. This process takes minutes, compared to months spent building knowledge bases in tools like Notion or Obsidian. The tool supports 75+ document formats and can export the generated graph to various formats, including graph databases and visualization software. This technology matters to AI developers and operators as it provides a rapid and structured understanding of complex information, enabling improved data analysis and visualization.

Kviklet is a self-hosted, Docker-based tool that enables secure access to production environments without hindering developer productivity. It implements the Four-Eyes Principle by requiring review and approval of individual SQL statements or temporary database sessions through a pull request-like workflow. This allows engineers to collaborate on database access without routing every query through a DBA or operations team. Kviklet supports various databases, including Postgres, MySQL, MariaDB, MS SQL Server, and MongoDB, and offers enterprise features such as SAML authentication, role-based review requirements, and API keys. It can be connected to existing identity providers, such as Google, Keycloak, or Active Directory, for single sign-on functionality.