Stop risky AI actions before they become incidents.
HOL Guard watches coding agents, MCP servers, skills, plugins, and local commands. Start with protection, then use these guides to understand the threats Guard is built to catch.
First minute path
Choose what you need from Guard right now.
Security content should move you toward action. Pick the path that matches your moment.
Threat map that leads somewhere.
Each public page teaches one risk, then points back to install, dashboard, docs, or a related harness setup.
Public proof, private work protected.
Redacted warnings show why Guard intervened without publishing raw prompts, tokens, paths, or private code.
Read redacted warningPractice safely before your next incident.
Labs are static simulations. They teach what Guard would do without executing dangerous commands.
Security advisories
Real attacks against AI agents and developer tools, with detection steps and fixes.
mcp-tool-poisoning
MCP tool description poisoning
Malicious MCP tool descriptions embed hidden instructions that redirect AI agents into calling the wrong tool, exfiltrating secrets, or executing unintended commands — even when the tool itself appears harmless.
Open guideprompt-injection
Prompt injection via issue comments and pull requests
Attackers embed hidden instructions in GitHub issues, PR comments, and commit messages. When an AI agent reads these to help triage or review, it follows the embedded instructions — potentially approving malicious code or leaking repository secrets.
Open guidesupply-chain
npm postinstall script abuse in AI coding environments
Malicious npm packages use postinstall scripts to execute arbitrary code during installation. In AI coding environments, these scripts can modify agent configuration, install backdoor MCP servers, or exfiltrate project secrets — all before the developer reviews the package.
Open guidemcp-tool-poisoning
Shadow MCP server discovery and persistent access
MCP servers added to a project during development can persist in configuration files and maintain access to the agent’s context window long after they are forgotten. These "shadow" servers continue receiving tool calls and may be modified by attackers who compromise the original server.
Open guideprompt-injection
Agent-readable config file poisoning
AI agents read configuration files like CLAUDE.md, .cursorrules, and AGENTS.md as trusted context. An attacker who can modify these files — via a compromised dependency, a malicious collaborator, or a typo in a path — gains the ability to inject persistent instructions the agent follows on every session.
Open guidesecret-exfiltration
Environment file exfiltration via webhook
AI agents can be tricked into reading .env files and sending their contents to external endpoints through tool calls, webhook integrations, or HTTP requests that appear legitimate.
Open guidedata-overexposure
Context window scraping via long file reads
AI agents that read large files can leak proprietary code, internal documentation, and customer data into their context window — which may then be sent to external LLM APIs or logged in cloud telemetry.
Open guideunsafe-command
Destructive command execution via injected instruction
Prompt injection can cause AI agents to run destructive shell commands like rm -rf, git push --force, or database drops — by embedding instructions in files, issues, or tool descriptions.
Open guidedata-overexposure
Cross-workspace credential leak via monorepo traversal
AI agents in monorepo environments can read credentials, configs, and secrets from adjacent workspaces — leaking data across team boundaries.
Open guideprompt-injection
Clipboard and terminal buffer injection
Attackers can plant hostile instructions in clipboard contents or terminal scrollback buffers. When an AI agent reads terminal output or the user pastes clipboard content, the hidden instructions execute as if they came from the user.
Open guidesecret-exfiltration
Gitignore bypass via agent file reads
AI agents can read files that are gitignored — secrets, private keys, and internal configs — because gitignore only prevents git tracking, not file system access. These files often contain the most sensitive data in a repository.
Open guidesecret-exfiltration
MCP authentication token theft via headers
MCP servers that accept authentication tokens in headers can leak those tokens if the server logs requests, shares telemetry, or is compromised. Tokens passed to MCP servers persist in server-side logs and may be accessible to attackers.
Open guideprompt-injection
Malicious skill with hidden prompt injection
AI agent skills (Claude Code skills, Cursor rules, Copilot extensions) can contain hidden prompt injections in their instructions. When the skill is loaded, the hidden prompt executes on every session that uses the skill.
Open guidemcp-tool-poisoning
Tool permission creep in AI agents
AI agents accumulate tool permissions over time as developers approve new tools "just this once." These permissions persist across sessions, creating an ever-widening attack surface where tools that were approved once can be used by prompt injection in future sessions.
Open guideprompt-injection
Indirect prompt injection via web content
When AI agents fetch web pages — documentation, Stack Overflow answers, package READMEs — the fetched content can contain hidden instructions that the agent follows, potentially exfiltrating data or executing unintended actions.
Open guideprompt-injection
Agent identity spoofing via system prompt mimicry
Attackers can craft content that mimics system prompts or tool outputs, tricking the agent into believing it received instructions from the harness, the user, or a trusted tool — when the instructions actually came from untrusted data.
Open guidesupply-chain
Dockerfile injection via AI agent writes
When AI agents write or modify Dockerfiles, prompt injection can cause them to add malicious instructions — pulling attacker-controlled base images, exfiltrating build secrets, or installing backdoors that persist across all container builds.
Open guidesupply-chain
CI/CD pipeline poisoning via agent-written config
AI agents that write CI/CD configuration files (GitHub Actions, GitLab CI, CircleCI) can introduce backdoors — injecting steps that exfiltrate secrets, modify artifacts, or deploy malicious code — that execute on every build.
Open guideprompt-injection
Model confusion via conflicting instructions
When an AI agent receives multiple conflicting instructions — from the user, the system prompt, tool descriptions, and file contents — it may follow the wrong one. Attackers exploit this by planting instructions that conflict with the user's actual intent.
Open guidedata-overexposure
Excessive file reading during project exploration
When AI agents explore a project to understand its structure, they often read dozens or hundreds of files — far more than needed for the task. This excessive reading can expose secrets, proprietary code, and customer data that enter the context window and model API.
Open guidesupply-chain
Stale dependency exploitation in AI environments
AI agents often work with projects that have outdated dependencies. When an agent suggests or installs packages based on a stale package.json, it can introduce known-vulnerable versions — and in AI environments, the vulnerability is amplified because the agent can execute commands.
Open guidedata-overexposure
Token cost amplification via context flooding
Attackers can craft content that causes AI agents to consume excessive tokens — by inserting large files, repetitive instructions, or recursive prompts that bloat the context window. This inflates API costs and can cause rate-limit denial of service.
Open guide