I scanned my AI agent framework for destructive/consequential actions, and wow
7 hours ago
- A static scan of 25 AI agent frameworks found 30 instances where model-controlled parameters could reach consequential actions without authorization checks.
- The scanner distinguishes between validation (checking form) and authorization (checking permission for the specific action), catching patterns like network egress, file writes, shell execution, and SQL injection.
- The study had 81% precision on its first run; 12 false positives were found and fixed, with regression tests added to prevent recurrence.
- The scanner covers frameworks like MCP, LangChain, and OpenAI but not custom agent loops or action/observation dispatchers.
- The scanner is publicly available with no dependencies or network calls, and can be run on local code with a simple command.