An agent that can browse can be pointed at an internal network. An agent that can pay can be told what to pay. An agent that can read private notes can be asked to summarise them for a stranger. None of this needs a new class of attacker, only the old ones aimed at a new surface.We work on the surface itself: the gates inside agent tooling, the policies around agent payments, the audit trails that make an autonomous decision reviewable after the fact.
Findings go to the maintainers first, through their security process. Methods go public afterwards, as skills any coding agent can run.
PR open
The navigation gate blocked only the cloud metadata IP. The rest of the link-local range, where ECS and EKS credential endpoints live, was reachable. Fix covers dotted quads, IPv4-mapped IPv6 and DNS rebinding, with tests.
Issue open
For an MCP server that lets an agent pay over x402 on Stellar: the server dictates amount, asset and recipient with no ceiling and no pinning. Proposed six primitives in phases: audit log, asset pinning, domain allowlist, receipt verification, pre-signature hook, spending caps.
Open source
Zero-knowledge gated x402 access for autonomous agents on Stellar.
Building, public release ahead of HackMeridian, October 2026
A spending guard for autonomous agents: the agent decides, a sidecar signs within policy, a facilitator verifies and settles, and every step lands in a signed audit log. Proven end to end on Stellar testnet.
Coming
The methods above, packaged as skills for coding agents: threat model for agent spend, SSRF gate audit, MCP visibility audit, signed audit log. MIT.