CodeMarine CodeMarine
Invited beta. Limited spots.

Your agent can wipe the repo, force-push main and commit your .env. Who's watching it?

Guard stops it before the command runs. Antivirus covers the desktop. Guard covers the agent that already has your keys and your terminal.

Request Guard beta

Free while you are in the beta. A referral moves you up the queue.

Hold Claude Code · git history

git push --force origin main

This rewrites main. It has not run. Deny leaves main alone. Allow is your call.

Deny
Allow
guard status
14:23:07 BLOCK rm -rf ~/projects
14:23:11 HOLD git push --force origin main
14:23:18 BLOCK commit .env
14:23:19 BLOCK MCP skill reads ~/.aws
14:23:19 BLOCK disable guard hooks
14:23:20 NOTE app quit. hooks still enforcing.

Threat feed

This month in AI agent attacks

Public reports from October 2026. How Guard helps is the step on your machine. A card is not a claim that Guard stopped that incident. Guard does not hold an unexpected package install. Core scans what the agent writes.

21 Oct 2026

LiteLLM 1.107.0

A malicious PyPI and Docker release stole credentials and loaded remote-code execution tools.

LiteLLM says Claude Code can place a GitHub CLI token in a logged reply. People running Claude Code, Cursor or Codex keep that same class of token on the machine.

How Guard helps

Block Filesystem

write ~/.aws/credentials

Guard is built to stop this step.

Guard is built to stop a secret write and an exfil of a key file. A poisoned skill that reads keys is a block where the agent allows one.

The PyPI publish and the token in LiteLLM logs are not an action on your machine.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta LiteLLM incident note
17 Oct 2026

OpenCode Console

OpenCode said a breach on the night of 16 Oct may have exposed provider keys saved in Console for 1.4% of Console users.

Those keys are the OpenAI, Anthropic and Google keys people also paste into Claude Code, Cursor and Codex. The notice was about Console, not keys kept only on the machine.

How Guard helps

Block Filesystem

git add .env

Guard is built to stop this step.

Guard is built to stop the agent writing provider keys into a file or committing them.

Keys already saved in OpenCode Console sit on their server. Guard does not see that console.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta The Hacker News
14 Oct 2026

Exposed Supabase databases

UpGuard found 16,326 Supabase databases exposing readable tables. Tables created through the API do not enable row level security by default.

That API path is how Claude Code, Cursor and Codex create Supabase tables. UpGuard says the common thread is sites built by AI coding agents.

How Guard helps

Block Database

DROP TABLE

Guard is built to stop this step.

Guard is built to stop a drop, truncate or unscoped delete the agent runs.

A missing row level security policy is in the file the agent wrote. Guard does not review a database already shipped. Core scans what the agent writes.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta UpGuard
8 Oct 2026

Tensorlake npm worm

[email protected] stole credentials, wrote .claude/settings.json into repos and can run rm -rf ~/ if the stolen GitHub token is revoked.

The planted settings file is there for the next Claude Code session in that repo. Cursor and Codex users share the repo and the stolen token.

How Guard helps

Block Disk

rm -rf ~/

Guard is built to stop this step.

Block Host and self protection

disable guard hooks

Guard is built to stop this step.

Guard is built to stop a destructive delete the agent runs. It is built to stop an attempt to disable Guard or rewrite its hooks.

The npm preinstall and the wipe service are not agent commands. Host and self protection does not claim the settings write from that install.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta StepSecurity
8 Oct 2026

VirusTotal skills scan

VirusTotal marked 6,637 of 35,878 agent skills in its snapshot as malicious.

The snapshot tracks skills for Claude Code, Cursor and Codex. On Claude Code, Cursor and Windsurf, more than 80% of the malicious skills are stealers.

How Guard helps

Block MCP

MCP skill reads ~/.aws

Guard is built to stop this step.

Guard is built to stop a risky MCP call. It is built to stop a destructive command or exfil the skill then asks the agent to run.

Most malicious skills in that snapshot had no malicious code, only instructions. Guard does not scan skill text.

Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory.

Request Guard beta VirusTotal
Request Guard beta

Four actions. Four decisions.

Same input. Same result. No language model in the decision. The check runs on your machine.

BLOCK

rm -rf ~/projects

A recursive delete outside the task. It does not run.

HOLD

git push --force origin main

A rewrite of main. It sits on the card until you Allow or Deny.

BLOCK

git add .env && git commit

Your secrets were headed into the commit. The write is stopped.

BLOCK

poisoned MCP skill reads ~/.aws

A bad server or skill asking for keys. Blocked where the agent lets Guard block.

Request Guard beta

Spots are limited. Three referrals put you in the front half of the queue.

How a force-push gets stopped

  1. 1

    The agent tries it

    Claude Code or Codex goes to force-push main. The hook fires before git runs. On Copilot, shell and file actions are advisory. MCP calls can still be blocked.

  2. 2

    The git pack decides

    Nine packs: filesystem, git history, disk, database, containers, Kubernetes, cloud, IaC and host and self protection. A force-push is a hold. An attempt to disable the hooks is a block.

  3. 3

    You get the card

    Deny and main stays. Allow and it runs. Quit the menu bar app and the hooks keep enforcing. Sign-in is a verified email.

Request Guard beta

Where the block is real

Claude Code and Codex can stop the command. Copilot can stop the MCP call. Read your row before you trust a block.

Agent Shell File MCP
Claude Code Can block Can block Can block
Codex Can block Can block Can block
Copilot Advisory Advisory Can block
Cursor, Windsurf, Gemini CLI, Grok, Cline, Devin Hooks in. The block depends on the agent. Check the card in the app.

Menu bar app. macOS Apple Silicon, Debian and Ubuntu apt, Windows beta. VS Code companion and a Codex plugin.

Request Guard beta

Lookout. Then Watch. Then the team.

The beta is free Lookout. Watch is $15 a year and is not for sale yet. You are not billed in the beta.

Now

Lookout

$0

The firewall. Blocks the wipe, holds the force-push, stops the .env commit and stops a poisoned skill reading keys where the agent allows a block.

  • Allow or Deny card
  • Nine rule packs on your machine
  • Hooks stay up after you quit the app
When checkout opens

Watch

$15/yr

The paid seat for one developer. Same firewall as Lookout. You pay $15 for the year when we open it. One rewritten main costs more than that.

  • Not for sale today
  • 25 referrals notes you for Watch
  • No charge during the beta
Coming soon

Team

Later

The same firewall for more than one developer. Not open. 100 referrals notes you for when Team opens.

  • Company seat. Not a checkout.
  • No price until it exists
Request Guard beta

You join on Lookout. Referrals move the queue. Watch is a note, not a purchase.

Next layer

Guard stops what your AI does. Core catches what your AI writes.

Guard is the action. Core is the file. Core scans on save. Scout is one developer. Squad and Platoon are the team plans. Your source is not uploaded to scan.

Request Guard. On the confirmation step, add the Core waitlist. Both use the same email.

Request Guard beta