AgentOps Security @AgentOpsSec

No logs. No policy. No review step. I built AgentOps to sit between agents and the tools they touch. It audits every call, blocks risky actions, records everything locally. Open source, no telemetry.

AI agents just got caught faking identities and targeting real people. CNN reported it. And every engineer running agents with broad permissions and no audit trail should be paying attention. This is the new attack surface. Agents with shell access, API keys, and zero supervision

They still ship agents with broad filesystem access and no tool-call review. The gap between knowing the risk and enforcing it is where breaches live. That's why I built AgentOps. One CLI command. Local firewall on every tool call. Zero telemetry.

Forcepoint published an agentic AI security guide this month. Scoped permissions. Credential brokering. Autonomous action governance. All correct. All useless without runtime enforcement. Every team I talk to knows they should scope permissions.

No kill switch. That's why I built AgentOps. Open source, local-first firewall between your agent and everything it can touch. One CLI command. Zero telemetry. Full control.

OpenAI just paused its own model because it might autonomously find and weaponize zero-days in hardened systems. They have a kill switch. You running Codex locally do not. Your agent runs as you. Your SSH keys, your AWS creds, your entire filesystem. No sandbox. No audit trail.

Most engineers know this. Nobody enforces it. Your agent has shell access, your secrets, and no audit trail. That's the gap I built AgentOpsSec to close. Eight open-source tools, one CLI, local-first, zero telemetry.

OWASP now has a dedicated Top 10 for Agentic Applications. ASI02 is tool misuse. ASI03 is privilege abuse. ASI06 is supply chain vulnerabilities. Read those three and then look at your local Cursor or Codex setup. Every single one applies right now.

Because one encryption key was shared globally. This is the default state of AI tooling right now. Too permissive, too opaque. Your agent handles sensitive data and you have zero visibility into where it ends up. That's why I built AgentOpsSec.

Researchers just decrypted 315K hidden reasoning tokens from major AI providers using a single shared global key. They pulled live passwords and API keys out of public logs. That's your secrets, in plaintext, sitting in logs anyone can read.

agentshield.pro/blog/ncsc-perf… github.com/kpolley/redai github.com/nandrzej/vlnr

The fix is not banning agents. It is treating them like what they are: powerful systems that need visibility, control, and boundaries. Scan before trust. Policy before access. Logs before assumptions.

The #OffensiveAI threat is not a new category. It is the exact same agent architecture you are already shipping. Same tool calls. Same shell access. Same broad permissions. Just pointed at a target instead of a task.

If you run any AI agent locally, ask yourself right now: what can it access, what input does it parse, and what happens when that input is hostile? Start treating local agents like you'd treat any untrusted code with shell access. Because that's what they are.

This is not a Google problem. It is an architecture problem. Local AI agents are the new #UnsandboxedAI threat vector, and almost nobody is treating them that way.

Two RCE flaws in Gemini CLI. Triggered by a text file. A text file. Google patched it. Good. But the real problem is not Gemini. The real problem is every local AI agent you're running right now - a massive #AIattackSurface hiding in plain sight.