Your agent test can pass while it leaks your API key — a 200-line fix
rudra-sh · reddit · 2026-10-13
A dev demos how a prompt-injected agent can exfiltrate secrets via a tool call and still report 'all done ✅' — tests that check agent output will pass. Their 200-line, zero-dependency agentverify instead inspects actual world state after the run to see if the secret really egressed, tests fail-closed behavior when guardrails are down, and flags policy changes that silently break prior protections. Author credits Pipelock and Microsoft RAMPART as heavy-duty versions; MIT licensed.
More from coding & agent
- RustGIS lands on PyPI: pure-Rust open-source GIS now runs inside Jupyter — giswqs · 2026-10-13
- AI creator reveals 5 unreleased Claude Skills, from video editing to personal agents — op7418 · 2026-10-13
- LangSmith launches AI Search: query agent traces in natural language — LangChain · 2026-10-13
- Dev builds a web design research skill that gets Claude to create bold branding concepts — round · 2026-10-13
- Kernel Panic conference in Madrid packs house, slides from four production-AI talks published — SergioPaniego · 2026-10-13
- This Hermes agent auto-filters weekly GitHub AI repos, search and fetch are free — prasenx · 2026-10-13