Ryan Dahl open-sources Claw Patrol: a protocol-level proxy that blocks dangerous agent actions
AI Engineer · youtube · 2026-08-18
In this talk, Deno founder Ryan Dahl shares production practice: Deno's incident-response agents have read/write access to production Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack, and now close incidents that used to wake a human. The real risk, he argues, is prompt injection through the support systems agents are wired into — security cannot be wishful thinking that a model stays obedient; the agent is untrusted software and the guard cannot live inside it.
Claw Patrol highlights
- An MIT-licensed proxy parsing every byte leaving the agent, below the HTTP layer, since dangerous paths are often not HTTP (an agent can spawn psql and tunnel to prod via an EKS endpoint, invisible to MCP tool permissions)
- Rules written in HCL (Terraform's language), checked into git and unit-tested against fixture requests; Deno's own file is 1,000 lines
- The proxy holds credentials (cookies, OAuth, AWS SigV4) so the agent never sees them; actions can route to an LLM judge, a human in Slack, or both
- Demo: Codex in yolo mode obeys an order to drop the users table, and the proxy kills it at the Postgres wire protocol; runs over Tailscale/WireGuard
More from coding & agent
- Agentic coding accessibility will reshape understanding of software complexity — pixlpa · 2026-08-24
- Devin Agent bypasses Slack block by finding emails in git logs — sandylikesfrogs · 2026-08-24
- Developer habits shift: Agents become collaborators from simple tools — latticecut · 2026-08-24
- Dev bottleneck shifts from writing to reading code: exe.dev co-founder — thursdai_pod · 2026-08-24
- The biggest AI mistake: trying to reinvent the wheel instead of using tools — Tired40s · 2026-08-24
- DeepPaperNote turns research papers into Obsidian notes — tom_doerr · 2026-08-24