# CodeMarine Guard reference CodeMarine Guard is a local action firewall for AI coding agents. Antivirus and a firewall protect the desktop. Guard watches the agent. Guard hooks into the agent before an action runs. It blocks destructive commands, secret writes and exfil, risky MCP calls and attempts to disable Guard. Borderline actions are held for an Allow or Deny card. The action does not run while the card is waiting. Decisions are deterministic. The same action gets the same decision. There is no language model in the loop. Guard runs on your machine and makes the decision there. Sign-in uses a verified email. Quitting the menu bar app does not drop the hooks. ## Delivery - Menu bar app for macOS Apple Silicon - Debian and Ubuntu via apt - Windows beta - VS Code companion - Codex plugin - Verified email sign-in ## Agents and coverage Guard hooks into Claude Code, Codex, Cursor, Windsurf, Gemini CLI, Copilot, Grok, Cline, Devin and others. Coverage is not equal: - Claude Code: shell, file and MCP actions can be blocked - Codex: shell, file and MCP actions can be blocked - Copilot: MCP calls can be blocked. Shell and file actions are advisory - Other agents: coverage varies. Read the card in the app before relying on a block Advisory means Guard can warn. It does not mean the action was stopped. ## Rule packs 1. Filesystem 2. Git history 3. Disk 4. Database 5. Containers 6. Kubernetes 7. Cloud 8. IaC 9. Host and self protection ## Plans - Lookout: free. This is the invited beta. The block, the Allow or Deny card and the nine packs. - Watch: 15 US dollars a year for one developer. Same firewall. Not on sale yet. No charge during the beta. - Team: later. More than one developer. Not open. - Invited beta: free Lookout. Limited spots. Referrals move the queue. ## CodeMarine Core Guard stops what the agent does. Core catches what the agent writes. Core scans on save. Plans are Scout, Squad and Platoon. Your source is never uploaded to scan. Detection is deterministic. There is no language model in the loop. ## Signup The enlist form posts to /api/enlist with email, an optional referrer code and a product field. Product is "guard" by default or "core". The API keeps the existing queue position, referral code and Slack alert. New signups increment meta:signups:guard or meta:signups:core. A later post with the same email and the other product appends it and increments that counter once. It does not create a second queue place. The confirmation step uses that to add Core. ## October 2026 reports These are public reports. Do not say Guard would have stopped them. How Guard helps is the local step: secret writes and exfil, risky MCP calls, destructive commands and attempts to disable Guard or rewrite its hooks. Claude Code and Codex can block shell, file and MCP. Copilot can block MCP. Shell and file on Copilot are advisory. Guard does not hold an unexpected package install. Core scans what the agent writes. Do not name curl, scp or a package-install hold. - 21 Oct 2026. LiteLLM v1.107.0 on PyPI and Docker stole credentials and loaded remote-code execution tools. LiteLLM says Claude Code can embed a GitHub CLI OAuth token in a logged response. The vendor note does not say the package stole ~/.cursor or ~/.claude configs. https://docs.litellm.ai/blog/security-incident-oct-21-2026 - 17 Oct 2026. OpenCode said a breach may have exposed provider keys saved in Console for 1.4% of Console users with an external provider linked. https://thehackernews.com/2026/10/opencode-console-breach-may-have.html - 14 Oct 2026. UpGuard found 16,326 Supabase databases exposing readable tables. Tables created through the API do not enable row level security by default. https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps - 8 Oct 2026. tensorlake@0.5.144 wrote .claude/settings.json into repos and can run rm -rf ~/ if the stolen GitHub token is revoked. https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm - 8 Oct 2026. VirusTotal found 6,637 of 35,878 agent skills malicious. https://blog.virustotal.com/2026/10/from-automation-to-infection-part-iii.html ## What not to claim - Machine learning or a language model inside the decision - A blanket latency number - A pattern-count number - A supported-language count - That code never leaves the machine in every case. Guard decides locally. Core source is not uploaded to scan. Email sign-in is separate - Customers, logos, testimonials or user counts - Sandboxing - Egress control - That every agent is protected the same way - That Guard would have stopped a named incident - Public documentation at docs.codemarine.ai. That host is behind Cloudflare Access - LiteLLM 1.107.0 stole ~/.cursor and ~/.claude configs. The vendor post does not say that. - Guard holds curl or scp of key files. Guard holds an unexpected package install. Those holds are not in the confirmed packs. ## Pages - https://codemarine.ai/ - https://codemarine.ai/guard - https://codemarine.ai/features - https://codemarine.ai/how-it-works - https://codemarine.ai/enlist - https://codemarine.ai/core - https://codemarine.ai/learn/ - https://codemarine.ai/about - https://codemarine.ai/privacy - https://codemarine.ai/terms ## Short answers What is Guard? A local action firewall for AI coding agents. It blocks or holds actions before they run. Is it an AI product? No. Decisions are deterministic rules. Does it keep working if the app is quit? Yes. The hooks stay up. Can I buy Watch? Not yet. Lookout is free. The invited beta is free. What is Core? The on-save scanner. Second product. Source is not uploaded to scan. ## Field Manual Security terms in plain English with official sources. Web version: https://codemarine.ai/learn/ ### WTF is a CVE? > Sarge says: A CVE is a bug's dog tag. It says which bug, not how bad. - Term: CVE - Also called: CVE ID; CVE IDs; CVE Record; CVE number; Common Vulnerabilities and Exposures; CVE Numbering Authority; CNA - Section: The basics - Web page: https://codemarine.ai/learn/wtf-is-a-cve/ #### Short version A CVE is a public ID for one specific security flaw, so everyone knows they are talking about the same bug. #### The briefing - **Stands for:** Common Vulnerabilities and Exposures. - **The dog tag:** Each flaw in the catalog gets one CVE Record, with an ID in the format CVE-YYYY-NNNN. - **The year:** When the ID was reserved or the flaw went public, not when it was found. - **The digits:** Arbitrary. A bigger number does not mean a worse bug. - **On the record:** At least the ID, a short description, the affected products and versions and some references. - **Who runs it:** The CVE Board sets the direction. MITRE currently runs the Secretariat that keeps the infrastructure going. - **Who assigns IDs:** CVE Numbering Authorities (CNAs): vendors, researchers, open source groups, CERTs and others, each authorized to cover its own patch of ground. GitHub is one. - **What it proves:** That the bug has a name. It does not prove the bug is dangerous or under attack. - **What it is not:** A severity score, which is not the CVE Program's job. It is also separate from the US National Vulnerability Database, which it feeds. #### In the Threat Brief this looks like > CVE-YYYY-NNNN: flaw in ExampleApp 3.x. Fixed in 3.2.1. That ID is the search term that cuts through the noise. The bulletin, the vendor and your scanner all mean the same bug. Example only. The product, versions and names are made up. #### What to do - Put the CVE ID into your vendor advisory, your scanner or your dependency tool. - For how bad, check the CVSS score. - For whether attackers are using it, check CISA KEV. #### Official sources - [CVE Program: Overview](https://www.cve.org/About/Overview) - [CVE Program: CVE Record lifecycle](https://www.cve.org/About/Process) - [CVE Program: CVE Numbering Authorities](https://www.cve.org/ProgramOrganization/CNAs) - [CVE Program: Structure](https://www.cve.org/ProgramOrganization/Structure) - [CVE Program: FAQs](https://www.cve.org/ResourcesSupport/FAQs) - [NIST: National Vulnerability Database](https://www.nist.gov/itl/nvd) #### Related - [CVSS](https://codemarine.ai/learn/cvss-severity.md) - [CISA KEV](https://codemarine.ai/learn/cisa-kev.md) - [Patch and advisory](https://codemarine.ai/learn/patch-and-advisory.md) ### WTF is CISA KEV? > Sarge says: On CISA's list means it has been seen working for real. Front of the queue. - Term: CISA KEV - Also called: KEV; KEV catalog; KEV list; Known Exploited Vulnerabilities; Known Exploited Vulnerabilities catalog; on CISA's list; CISA's list - Section: Under attack - Web page: https://codemarine.ai/learn/cisa-kev/ #### Short version The KEV catalog is the US government list of security flaws with reliable evidence of real attacks. #### The briefing - **CISA:** The US Cybersecurity and Infrastructure Security Agency. - **KEV:** Its Known Exploited Vulnerabilities catalog. - **The one question:** Is anyone actually getting hit by this? - **Bar 1:** The flaw has a CVE ID. - **Bar 2:** There is reliable evidence it has been actively exploited in the wild. - **Bar 3:** There is a clear fix, such as a vendor update. - **Does not count:** Scanning, security research and a proof of concept are not active exploitation. - **Each entry shows:** A due date and whether the flaw is known to be used in ransomware campaigns. - **Who must act:** US federal civilian agencies must fix entries within set timeframes under Binding Operational Directive 26-04, issued in June 2026. - **Old rulebook:** BOD 26-04 replaced BOD 22-01, so older write-ups will quote the wrong one. - **Everyone else:** Nobody else is bound by it, but CISA strongly recommends every organization watch the list. - **Do not read it backwards:** A flaw with no CVE ID or no clear fix cannot get on it, so missing from KEV does not mean safe. #### In the Threat Brief this looks like > CVE-YYYY-NNNN in ExampleApp is on CISA's list. About the loudest alarm in this business. The bug has been seen working for real, not just in a lab. Example only. The product, versions and names are made up. #### What to do - If you run the affected product, move it to the front of the queue. - Do not wait for a quiet week. - Do not treat a missing entry as an all clear. - Want it in your tooling? The catalog also comes as CSV and JSON. #### Official sources - [CISA: Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities) - [CISA: BOD 26-04, Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk) #### Related - [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md) - [CVE](https://codemarine.ai/learn/wtf-is-a-cve.md) - [CVSS](https://codemarine.ai/learn/cvss-severity.md) ### WTF does "exploited in the wild" mean? > Sarge says: Lab bugs are drills. This one is live fire. - Term: Exploited in the wild - Also called: in the wild; actively exploited; active exploitation; known exploited - Section: Under attack - Web page: https://codemarine.ai/learn/exploited-in-the-wild/ #### Short version Exploited in the wild means attackers are using a flaw on real targets, not just researchers in a lab. #### The briefing - **Before:** Someone reports a bug, a researcher may build a proof of concept to show it is real and that can be the end of it. - **In the wild:** The next step up: real attackers, real systems, real damage. - **Vulnerability:** The hole in the wall. - **Exploit:** The tool that goes through it. - **Exploitation in the wild:** Someone using that tool on live targets. Headlines mash these three together, so keep them apart. - **CISA's hard line:** For its KEV list it wants reliable evidence of active exploitation. Scanning, security research and a proof of concept do not count. - **No public exploit needed:** A public proof of concept is not required either, because attackers do not publish their homework. - **CVSS or this:** CVSS tells you how bad a bug could be. This tells you the shooting has started. - **Order of march:** A lower-scored bug under live attack can deserve your morning more than a critical one nobody is using. - **A patch is not an eviction:** It closes the hole. It does not remove anyone already inside. BOD 26-04 pairs some fixes for federal agencies with a forensic triage to assess whether the system is compromised. #### In the Threat Brief this looks like > CVE-YYYY-NNNN in ExampleApp is being actively exploited in the wild. This is not a lab result. If you run the affected version, it just became your next job. Example only. The product, versions and names are made up. #### What to do - If you run the affected version, treat it as urgent. - Fix it first. - Then check whether you were hit before the fix landed. #### Official sources - [CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities) - [CISA: BOD 26-04, Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk) - [FIRST: Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss/) #### Related - [CISA KEV](https://codemarine.ai/learn/cisa-kev.md) - [Zero-day](https://codemarine.ai/learn/zero-day.md) - [Indicators of compromise](https://codemarine.ai/learn/indicators-of-compromise.md) ### WTF is a zero-day? > Sarge says: Zero days of warning. You fight with the defenses you already have. - Term: Zero-day - Also called: zero day; 0-day; 0day; zero-day attack; zero-day vulnerability; zero-day exploit - Section: Under attack - Web page: https://codemarine.ai/learn/zero-day/ #### Short version A zero-day is a flaw that gets attacked while it is still unknown, so defenders had no warning. #### The briefing - **NIST's definition:** An attack that exploits a previously unknown hardware, firmware or software vulnerability. - **The name:** It is about the head start. The defenders got zero days of warning. - **Loose use:** You will see the word on flaws that are public with no patch yet and on bugs that were fixed weeks ago. - **Zero-day or in the wild:** A zero-day attack is exploitation in the wild by definition, but a flaw can stay under attack long after its fix ships. - **Old bugs still kill:** CISA warns that attackers may target vulnerabilities for months or even years after updates are available. - **No fix yet:** You cannot patch what nobody has fixed, so a true zero-day tests everything else you have. #### In the Threat Brief this looks like > Zero-day in ExampleApp. No patch yet. That word gets used loosely, so read the advisory. If there really is no fix, your other defenses are doing the work. Example only. The product, versions and names are made up. #### What to do - Read the advisory and ask two questions. Is a fix out? Is it being attacked? - Lean on least privilege, short-lived credentials, separation between systems and logging. - Layer your defenses so that when one fails, the next one catches it. - When the fix ships, take it fast and from the vendor directly. Attackers read advisories too. - Then check for signs of compromise, since the attack started before the fix existed. #### Official sources - [NIST CSRC Glossary: zero day attack](https://csrc.nist.gov/glossary/term/zero_day_attack) - [CISA: Understanding Patches and Software Updates](https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates) - [CISA: Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) #### Related - [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md) - [Patch and advisory](https://codemarine.ai/learn/patch-and-advisory.md) - [Indicators of compromise](https://codemarine.ai/learn/indicators-of-compromise.md) ### WTF is a CVSS score? > Sarge says: CVSS tells you how hard the round hits, not whether it is headed your way. - Term: CVSS - Also called: CVSS score; CVSS rating; CVSS-B; severity score; severity rating; Common Vulnerability Scoring System - Section: The basics - Web page: https://codemarine.ai/learn/cvss-severity/ #### Short version CVSS is a 0 to 10 score for how severe a security flaw is, not how likely it is to hit you. #### CVSS severity scale | Rating | CVSS score | | --- | --- | | None | 0.0 | | Low | 0.1 to 3.9 | | Medium | 4.0 to 6.9 | | High | 7.0 to 8.9 | | Critical | 9.0 to 10.0 | #### The briefing - **Who owns it:** The Common Vulnerability Scoring System is owned and managed by FIRST, a US-based non-profit. - **Version:** Currently 4.0. - **Base score:** The number you usually see, written CVSS-B in version 4.0. It rates the flaw itself: can it be reached over the network, does the attacker need a login, what can they do once through. - **Blind spots:** The base score knows nothing about your setup or whether anyone is using the bug right now. - **The rest is your job:** CVSS has Threat and Environmental metrics to adjust for those things, but publishers typically give only the base score. - **FIRST says it plainly:** Base scores measure severity and should not be used alone to assess risk. - **EPSS:** Also from FIRST: an estimated probability that a CVE will be exploited in the wild in the next 30 days. A forecast, not a sighting. #### In the Threat Brief this looks like > CVE-YYYY-NNNN in ExampleApp. CVSS 9.8 (Critical). Critical is how bad the flaw is, not how likely it is to hit you. A critical on a system you do not run is noise. Example only. The product, versions and names are made up. #### What to do - Treat the score as one input. CVSS tells you how bad. - Check KEV to see if it is being used. - Let your own exposure decide the rest. A high on your internet-facing login page, listed on KEV, is your morning. #### Official sources - [FIRST: Common Vulnerability Scoring System](https://www.first.org/cvss/) - [FIRST: CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document) - [FIRST: CVSS v4.0 User Guide](https://www.first.org/cvss/v4.0/user-guide) - [FIRST: Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss/) #### Related - [CVE](https://codemarine.ai/learn/wtf-is-a-cve.md) - [CISA KEV](https://codemarine.ai/learn/cisa-kev.md) - [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md) ### WTF are patches and advisories? > Sarge says: The advisory is your orders. The patch is the fix. Read one, apply the other. - Term: Patch and advisory - Also called: patch; security patch; advisory; security advisory; vendor advisory; release notes; upgrade to version; fixed version; affected versions - Section: The basics - Web page: https://codemarine.ai/learn/patch-and-advisory/ #### Short version An advisory tells you what is broken and which versions are hit. A patch is the fix. #### Life of a bug 1. **Flaw found:** Someone spots a security flaw in a product. 2. **CVE assigned:** A CVE Numbering Authority gives it an ID, so everyone means the same bug. 3. **Advisory:** The official notice: what is broken and which versions are hit. 4. **Patch:** The update that repairs the flaw. Attackers read advisories too. 5. **Exploited, added to CISA KEV:** Attackers hit real targets. With reliable evidence and a clear fix, it goes on the list. 6. **You patch:** Move to the fixed version, then check for signs of compromise. Real bugs do not always march in this order. A zero-day is attacked before any fix exists, and plenty of bugs never reach step 5. #### The briefing - **Advisory:** The official notice about a flaw. A useful one gives a description, the severity, the affected versions and the patched versions, plus any workaround. - **Who publishes them:** GitHub advisories carry those fields, and vendors publish their own. - **Patch:** The update that repairs the flaw. CISA describes patches as software and operating system updates that address security vulnerabilities. - **Release notes:** The changelog for that update. A security fix can get one dull line in there, so read the advisory as well. - **"Upgrade to version X":** X is the fixed version, usually the earliest one. Any version in the affected range is a target until you move to X or later. - **Trap: no fix version:** A malicious package has none. GitHub says the only safe course is not to use the package at all. - **Trap: the quiet patch:** A patch closes the hole without telling you who came through it first. #### In the Threat Brief this looks like > Affected: ExampleApp 2.0 to 2.3.4. Upgrade to version 2.3.5. Everything in that range is a target until you run 2.3.5 or later. Example only. The product, versions and names are made up. #### What to do - Check the version you actually run, including copies buried in your dependency tree. Lock files such as package-lock.json will show them. - Update as soon as you can and turn on automatic updates where that makes sense. - Get updates from the vendor directly. CISA warns that attackers use emails to push malicious files disguised as legitimate updates, so do not trust the link in the message. #### Official sources - [CISA: Understanding Patches and Software Updates](https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates) - [CISA: Cybersecurity Alerts and Advisories](https://www.cisa.gov/news-events/cybersecurity-advisories) - [NIST CSRC Glossary: patch](https://csrc.nist.gov/glossary/term/patch) - [GitHub Docs: Repository security advisories](https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories) - [GitHub Docs: GitHub Advisory Database](https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database) #### Related - [CVE](https://codemarine.ai/learn/wtf-is-a-cve.md) - [Zero-day](https://codemarine.ai/learn/zero-day.md) - [Indicators of compromise](https://codemarine.ai/learn/indicators-of-compromise.md) ### WTF is a supply chain attack? > Sarge says: You locked the front gate. The enemy rode in on the supply truck. - Term: Supply chain attack - Also called: software supply chain attack; supply chain compromise; poisoned package; malicious package; compromised package; malicious extension; typosquatting - Section: AI agent threats - Web page: https://codemarine.ai/learn/supply-chain-attack/ #### Short version A supply chain attack reaches you through something you already trust, like a package, extension or update. #### The briefing - **OWASP's take:** Breakdowns or compromises in the process of building, distributing or updating software. They sit at A03 in its 2025 Top 10. - **Poisoned package:** Attackers add malicious behavior to a popular package. - **Typosquatting:** They register a lookalike name to catch a typo. - **Trusted vendor:** They compromise a vendor so the bad code arrives as an upgrade. - **Real example:** In September 2025 CISA warned of a self-replicating worm called Shai-Hulud that compromised over 500 npm packages. - **What it did:** It hunted for GitHub tokens and cloud API keys, sent them out, then used stolen developer access to publish more compromised packages. - **Editor extensions:** Same firing line. VS Code says an extension can do anything VS Code can, including reading and writing files, making network requests and running external processes. - **The nasty part:** All you did was update. The bad code lands on developer machines, which is where the tokens and cloud keys live. #### In the Threat Brief this looks like > example-package 4.1.7 on npm is malicious. Check your lock files. The exact version is what you hunt for. All it took was an update. Example only. The product, versions and names are made up. #### What to do - Check your lock files and installed extensions for the exact version the alert names. - Pin to a known good release. - If the bad one ever ran, rotate every credential that machine could reach. - Then go looking for indicators of compromise. #### Official sources - [OWASP Top 10 2025: A03 Software Supply Chain Failures](https://top10.owasp.org/2025/A03_2025-Software_Supply_Chain_Failures/) - [CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem) - [NIST CSRC Glossary: supply chain attack](https://csrc.nist.gov/glossary/term/supply_chain_attack) - [npm Docs: Threats and mitigations](https://docs.npmjs.com/threats-and-mitigations) - [VS Code Docs: Extension runtime security](https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security) #### Related - [Indicators of compromise](https://codemarine.ai/learn/indicators-of-compromise.md) - [Patch and advisory](https://codemarine.ai/learn/patch-and-advisory.md) - [MCP server](https://codemarine.ai/learn/mcp-servers.md) ### WTF are indicators of compromise? > Sarge says: Patched is not clear. Check for boot prints before you stand down. - Term: Indicators of compromise - Also called: indicator of compromise; IoC; IoCs; signs of compromise; check for signs of compromise - Section: Under attack - Web page: https://codemarine.ai/learn/indicators-of-compromise/ #### Short version Indicators of compromise are the tracks an attacker leaves behind, like a rogue account, file or domain. #### The briefing - **NIST's definition:** A technical artifact or observable that suggests an attack is imminent or underway, or that a compromise may already have occurred. - **In plain terms:** Boot prints in the mud. - **Specific tracks:** Advisories usually give you things to hunt for, such as a domain the malware talks to or a repository it creates. - **Real example:** CISA called out webhook.site connections and a public repository named Shai-Hulud in its 2025 npm alert. - **General tracks:** CISA's ransomware guide lists newly created services, unexpected scheduled tasks, unexpected software, new accounts or accounts with escalated privileges and abnormal amounts of data going out. - **"Check for signs of compromise":** Do not patch and walk away. Find out if someone got in before you shut the door. - **A clean search:** It only means you did not find those tracks. It is not proof nobody was there. #### In the Threat Brief this looks like > Check for signs of compromise: connections to example.net and a new repository named example-worm. Those are the tracks to hunt for. Search for them even if you have already patched. Example only. The product, versions and names are made up. #### What to do - If you ran the affected version, search your logs, lock files and machines for what the advisory lists. - If you find something, do not start wiping. - Follow CISA's ransomware guide: determine which systems were impacted, isolate them and take a system image and memory capture from a sample of affected devices. - Keep the evidence, get help if you need it and rotate the credentials that system could reach. #### Official sources - [NIST CSRC Glossary: indicator](https://csrc.nist.gov/glossary/term/indicator) - [CISA: #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) - [CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem) - [CISA: BOD 26-04, Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk) #### Related - [Supply chain attack](https://codemarine.ai/learn/supply-chain-attack.md) - [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md) - [Patch and advisory](https://codemarine.ai/learn/patch-and-advisory.md) ### WTF is prompt injection? > Sarge says: Your agent can take orders from anything it reads. Assume the enemy wrote some of it. - Term: Prompt injection - Also called: direct prompt injection; indirect prompt injection; prompt injection attack; LLM01 - Section: AI agent threats - Web page: https://codemarine.ai/learn/prompt-injection/ #### Short version Prompt injection is when text an AI reads tricks it into following an attacker instead of you. #### The briefing - **OWASP rank:** LLM01, the top entry in its 2025 list for large language model applications. - **The cause:** Models get instructions and data as one stream of natural language, with no clear line between them. Orders and mail arrive on the same radio channel. - **Direct injection:** Someone types the attack straight into the prompt. - **Indirect injection:** The dangerous one for developers. The attack hides in something the model reads: a web page, an email, a file, a code comment, an issue or a commit message. - **You may never see it:** OWASP notes the input does not need to be human-readable as long as the model parses it. Its examples include white text on a white background and non-printing Unicode characters. - **What is at stake:** A tricked chatbot says something silly. A tricked coding agent has your shell, your files and your tools. Hidden instructions in a README can steer it toward your secrets or commands you would never approve. - **No silver bullet:** OWASP says it is unclear if there are fool-proof methods of prevention, and that screening input is not a security boundary. #### In the Threat Brief this looks like > Indirect prompt injection in ExampleAgent: a crafted README can steer it toward local secrets. The attack is in the text, not in your prompt. Your agent only had to read the file. Example only. The product, versions and names are made up. #### What to do - Plan on it happening. - Limit what the agent can touch. - Keep a human approval on risky actions. - Treat anything it reads or gets back from a tool as untrusted. #### Official sources - [OWASP: LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) - [OWASP: Prompt Injection](https://community.owasp.org/attacks/PromptInjection) - [OWASP: LLM Prompt Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html) #### Related - [MCP server](https://codemarine.ai/learn/mcp-servers.md) - [Supply chain attack](https://codemarine.ai/learn/supply-chain-attack.md) - [RCE and privilege escalation](https://codemarine.ai/learn/rce-and-privilege-escalation.md) ### WTF is an MCP server? > Sarge says: An MCP server is not a bookmark. Know who wrote it before it touches your agent. - Term: MCP server - Also called: MCP; MCP servers; Model Context Protocol; tool poisoning; rug pull - Section: AI agent threats - Web page: https://codemarine.ai/learn/mcp-servers/ #### Short version An MCP server plugs outside tools and data into an AI agent, and those tools can do real things. #### The briefing - **MCP:** Model Context Protocol, an open-source standard for connecting AI applications to external systems. Its docs call it a USB-C port for AI applications. - **Server:** The program on the other end. It offers tools the AI can invoke, resources it can read and prompt templates. It can run on your machine or remotely. - **The spec's warning:** Tools represent arbitrary code execution, and hosts must get explicit user consent before invoking one. - **The catch:** MCP cannot enforce that at the protocol level, so it comes down to each app. - **Local servers:** MCP security guidance says they are binaries downloaded and executed on the same machine as the client, and lists arbitrary code execution and data exfiltration among the risks. - **Tool poisoning:** OWASP: malicious instructions hidden in tool descriptions or return values. - **Rug pull:** OWASP: a server changing its tool definitions after you approved them. #### In the Threat Brief this looks like > Tool poisoning in example-mcp-server 1.2.0: hidden instructions in a tool description. You approved a tool and got its orders too. Tool text can carry prompt injection straight to your agent. Example only. The product, versions and names are made up. #### What to do - Know who publishes it. Installing one is closer to running a stranger's program than adding a bookmark. - Read the exact command before you approve it. - Do not assume a tool you approved yesterday is the same tool today. - Treat tool descriptions and responses as untrusted. The spec and OWASP both say so. #### Official sources - [MCP: What is the Model Context Protocol?](https://modelcontextprotocol.io/docs/getting-started/intro) - [MCP: Specification](https://modelcontextprotocol.io/specification/2026-07-28) - [MCP: Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) - [OWASP: MCP Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html) - [OWASP: MCP Top 10 (beta)](https://owasp.org/projects/mcp-top-10) #### Related - [Prompt injection](https://codemarine.ai/learn/prompt-injection.md) - [Supply chain attack](https://codemarine.ai/learn/supply-chain-attack.md) - [RCE and privilege escalation](https://codemarine.ai/learn/rce-and-privilege-escalation.md) ### WTF are RCE and privilege escalation? > Sarge says: RCE gets them through the wire. Privilege escalation gets them the keys to the base. - Term: RCE and privilege escalation - Also called: RCE; remote code execution; privilege escalation; privesc; root access; root privileges; full takeover; chained flaws; exploit chain; vulnerability chain - Section: Under attack - Web page: https://codemarine.ai/learn/rce-and-privilege-escalation/ #### Short version RCE lets an attacker run their code on your system. Privilege escalation gets them more power once inside. #### The briefing - **RCE:** Remote code execution. An attacker can make a system run their code from somewhere else, often over a network. CVSS calls that kind of reach "remotely exploitable". - **Classic cause:** Injection, where software treats outside input as code or commands. - **Privilege escalation:** MITRE ATT&CK describes it as techniques adversaries use to gain higher-level permissions. They often get in with unprivileged access, then climb to local administrator or SYSTEM/root. - **"Root":** The top account on Linux and macOS. SYSTEM is the Windows equivalent. Whoever holds it runs the machine. - **"Full takeover":** Headline language, not a formal rating. Read the advisory to see what the attacker really gets. - **"Chained flaws":** One bug sets up the next. The first gets a foothold and the second gets root. The MITRE CWE catalog labels real examples of these chains. - **One number will not do:** Each flaw normally gets its own CVE and its own score, so one number will not show you the whole attack. #### In the Threat Brief this looks like > Chained flaws in ExampleApp give an attacker root. Full takeover. One bug set up the next. "Full takeover" is headline language, so read the advisory for what the attacker really gets. Example only. The product, versions and names are made up. #### What to do - Put an RCE on anything facing the internet at the top of the pile. If it needs no login, go faster. - Do not wave off a "local" or low-privilege bug. It may be the second link in someone's chain. - Run things with the least privilege they need. That limits what an attacker inherits when something breaks. #### Official sources - [MITRE ATT&CK: Privilege Escalation (TA0004)](https://attack.mitre.org/tactics/TA0004/) - [MITRE CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html) - [MITRE CWE-78: OS Command Injection](https://cwe.mitre.org/data/definitions/78.html) - [OWASP: Code Injection](https://community.owasp.org/attacks/Code_Injection) - [FIRST: CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document) #### Related - [CVSS](https://codemarine.ai/learn/cvss-severity.md) - [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md) - [Prompt injection](https://codemarine.ai/learn/prompt-injection.md)