AI antivirus for agentic code
Stop risky AI actions
before they become incidents.
HOL Guard watches coding agents, MCP servers, skills, plugins, and local commands. Start with protection, then use these guides to understand the threats Guard is built to catch.
Choose what you need from Guard right now.
Security content should move you toward action. Pick the path that matches your moment.
Threat map that leads somewhere.
Each public page teaches one risk, then points back to install, dashboard, docs, or a related harness setup.
Threat dossier library
Deep evidence pages for every canonical agent threat. Each dossier publishes a representative attack path, an honest coverage line, an incident-response procedure, and its primary sources.
Priority research9
- Indirect prompt injectionIndirect prompt injection occurs when hostile instructions are embedded in content an agent reads rather than in the user prompt itself.P1 · reviewed Aug 9, 2026
- MCP tool poisoning and rug pullsMCP tool poisoning occurs when a server or tool definition presents misleading instructions, capabilities, or returned content; a rug pull changes trusted behavior after review or approval.P1 · reviewed Aug 9, 2026
- Secret exfiltration by agentsSecret exfiltration happens when an agent reads credentials or sensitive material and then exposes them through a tool, command, log, model request, or external destination.P1 · reviewed Aug 9, 2026
- Malicious packages and install scriptsA malicious package can execute code during install or runtime, abuse trusted names or publishers, and steal credentials before the application ever imports it.P1 · reviewed Aug 9, 2026
- Unsafe shell and destructive commandsUnsafe command execution is the point where an agent turns a mistaken, poisoned, or overbroad plan into a shell action with destructive or irreversible consequences.P1 · reviewed Aug 9, 2026
- Identity spoofing and confused deputyIdentity spoofing lets an attacker or tool output impersonate a trusted principal — a user, an upstream agent, or a service — so a consequential action is authorized on behalf of the wrong identity, the classic confused-deputy failure.P1 · reviewed Sep 5, 2026
- Sandbox and permission-boundary breakoutA sandbox or permission-boundary breakout happens when agent work loses containment — approval prompts are bypassed with auto-approve flags, broad shell access, or escalated credentials — so any injected or mistaken plan runs unattended on the machine.P1 · reviewed Sep 5, 2026
- Slopsquatting and package hallucinationSlopsquatting is the supply-chain attack in which attackers register package names that AI models reliably hallucinate; when an agent writes an import for a package that never existed, the attacker’s registered code installs instead.P1 · reviewed Sep 5, 2026
- Malicious extensions and marketplace fraudMalicious extensions and marketplace fraud place trojanized editor extensions, plugins, or CI actions inside trusted marketplaces, harvesting source code, prompts, and credentials from every developer who installs them.P1 · reviewed Sep 5, 2026
Extended research9
- Memory and context poisoningMemory poisoning stores attacker-controlled or incorrect context so it can influence later agent decisions after the original malicious input is gone.P2 · reviewed Aug 9, 2026
- Workspace and instruction-file poisoningWorkspace instruction poisoning places hostile or misleading natural-language policy inside files an agent automatically treats as project guidance.P2 · reviewed Aug 9, 2026
- Excessive agency and privilege escalationExcessive agency exists when an agent has more tools, permissions, identity authority, or autonomous execution scope than its task requires.P2 · reviewed Aug 9, 2026
- Tool-result injectionTool-result injection occurs when an API, MCP server, command output, retrieved document, or other tool response contains hostile instructions that the agent treats as trusted guidance.P2 · reviewed Aug 9, 2026
- Agent-to-agent delegated trustDelegated-trust risk appears when one agent accepts another agent’s identity, instructions, claims, or requested actions without enough verification or scope control.P2 · reviewed Aug 9, 2026
- Insecure output handling and terminal injectionInsecure output handling is the failure to treat tool output, command results, and terminal rendering as untrusted input; hidden ANSI escape sequences and embedded instructions then steer the agent or deceive the operator reviewing its work.P2 · reviewed Sep 5, 2026
- RAG and knowledge-base poisoningRAG poisoning corrupts the documents an agent retrieves, so a small number of injected texts reliably steer answers and downstream actions long after the attacker’s original interaction ended.P2 · reviewed Sep 5, 2026
- System prompt leakageSystem prompt leakage exposes the instructions — and sometimes credentials — that steer an agent, handing attackers the exact rules, tool inventory, and guardrails they need to craft a bypass.P2 · reviewed Sep 5, 2026
- Automation bias and approval fatigueAutomation bias is the documented human tendency to approve what an automated system requests; when developers face frequent agent approval prompts, they rubber-stamp the risky request along with the routine ones.P2 · reviewed Sep 5, 2026
Public proof, private work protected.
Redacted warnings show why Guard intervened without publishing raw prompts, tokens, paths, or private code.
REDACTED · no raw prompts, no private paths
Practice safely before your next incident.
Labs are static simulations. They teach what Guard would do without executing dangerous commands.
How HOL Guard maps to the OWASP MCP Top 10
Detect, prevent at runtime, and honest gaps against the OWASP MCP Top 10. This is not a claim of complete MCP security.
Open OWASP MCP mappingSecurity advisories
Real attacks against AI agents and developer tools, with detection steps and fixes.
MCP tool description poisoning
Malicious MCP tool descriptions embed hidden instructions that redirect AI agents into calling the wrong tool, exfiltrating secrets, or executing unintended commands — even when the tool itself appears harmless.
Mitigation
Review new MCP tool descriptions word-by-word, compare declared behavior with actual tool calls, and require team approval before trusting changed tools. Use Guard to pause on new or modified MCP tools.
Prompt injection via issue comments and pull requests
Attackers embed hidden instructions in GitHub issues, PR comments, and commit messages. When an AI agent reads these to help triage or review, it follows the embedded instructions — potentially approving malicious code or leaking repository secrets.
Read advisorycriticalsupply-chainnpm postinstall script abuse in AI coding environments
Malicious npm packages use postinstall scripts to execute arbitrary code during installation. In AI coding environments, these scripts can modify agent configuration, install backdoor MCP servers, or exfiltrate project secrets — all before the developer reviews the package.
Read advisorymediummcp-tool-poisoningShadow MCP server discovery and persistent access
MCP servers added to a project during development can persist in configuration files and maintain access to the agent’s context window long after they are forgotten. These "shadow" servers continue receiving tool calls and may be modified by attackers who compromise the original server.
Read advisoryhighprompt-injectionAgent-readable config file poisoning
AI agents read configuration files like CLAUDE.md, .cursorrules, and AGENTS.md as trusted context. An attacker who can modify these files — via a compromised dependency, a malicious collaborator, or a typo in a path — gains the ability to inject persistent instructions the agent follows on every session.
Read advisorycriticalsecret-exfiltrationEnvironment file exfiltration via webhook
AI agents can be tricked into reading .env files and sending their contents to external endpoints through tool calls, webhook integrations, or HTTP requests that appear legitimate.
Read advisorymediumdata-overexposureContext window scraping via long file reads
AI agents that read large files can leak proprietary code, internal documentation, and customer data into their context window — which may then be sent to external LLM APIs or logged in cloud telemetry.
Read advisoryhighunsafe-commandDestructive command execution via injected instruction
Prompt injection can cause AI agents to run destructive shell commands like rm -rf, git push --force, or database drops — by embedding instructions in files, issues, or tool descriptions.
Read advisorymediumdata-overexposureCross-workspace credential leak via monorepo traversal
AI agents in monorepo environments can read credentials, configs, and secrets from adjacent workspaces — leaking data across team boundaries.
Read advisorymediumprompt-injectionClipboard and terminal buffer injection
Attackers can plant hostile instructions in clipboard contents or terminal scrollback buffers. When an AI agent reads terminal output or the user pastes clipboard content, the hidden instructions execute as if they came from the user.
Read advisoryhighsecret-exfiltrationGitignore bypass via agent file reads
AI agents can read files that are gitignored — secrets, private keys, and internal configs — because gitignore only prevents git tracking, not file system access. These files often contain the most sensitive data in a repository.
Read advisoryhighsecret-exfiltrationMCP authentication token theft via headers
MCP servers that accept authentication tokens in headers can leak those tokens if the server logs requests, shares telemetry, or is compromised. Tokens passed to MCP servers persist in server-side logs and may be accessible to attackers.
Read advisoryhighprompt-injectionMalicious skill with hidden prompt injection
AI agent skills (Claude Code skills, Cursor rules, Copilot extensions) can contain hidden prompt injections in their instructions. When the skill is loaded, the hidden prompt executes on every session that uses the skill.
Read advisorymediummcp-tool-poisoningTool permission creep in AI agents
AI agents accumulate tool permissions over time as developers approve new tools "just this once." These permissions persist across sessions, creating an ever-widening attack surface where tools that were approved once can be used by prompt injection in future sessions.
Read advisoryhighprompt-injectionIndirect prompt injection via web content
When AI agents fetch web pages — documentation, Stack Overflow answers, package READMEs — the fetched content can contain hidden instructions that the agent follows, potentially exfiltrating data or executing unintended actions.
Read advisoryhighprompt-injectionAgent identity spoofing via system prompt mimicry
Attackers can craft content that mimics system prompts or tool outputs, tricking the agent into believing it received instructions from the harness, the user, or a trusted tool — when the instructions actually came from untrusted data.
Read advisoryhighsupply-chainDockerfile injection via AI agent writes
When AI agents write or modify Dockerfiles, prompt injection can cause them to add malicious instructions — pulling attacker-controlled base images, exfiltrating build secrets, or installing backdoors that persist across all container builds.
Read advisorycriticalsupply-chainCI/CD pipeline poisoning via agent-written config
AI agents that write CI/CD configuration files (GitHub Actions, GitLab CI, CircleCI) can introduce backdoors — injecting steps that exfiltrate secrets, modify artifacts, or deploy malicious code — that execute on every build.
Read advisorymediumprompt-injectionModel confusion via conflicting instructions
When an AI agent receives multiple conflicting instructions — from the user, the system prompt, tool descriptions, and file contents — it may follow the wrong one. Attackers exploit this by planting instructions that conflict with the user's actual intent.
Read advisorymediumdata-overexposureExcessive file reading during project exploration
When AI agents explore a project to understand its structure, they often read dozens or hundreds of files — far more than needed for the task. This excessive reading can expose secrets, proprietary code, and customer data that enter the context window and model API.
Read advisorymediumsupply-chainStale dependency exploitation in AI environments
AI agents often work with projects that have outdated dependencies. When an agent suggests or installs packages based on a stale package.json, it can introduce known-vulnerable versions — and in AI environments, the vulnerability is amplified because the agent can execute commands.
Read advisorylowdata-overexposureToken cost amplification via context flooding
Attackers can craft content that causes AI agents to consume excessive tokens — by inserting large files, repetitive instructions, or recursive prompts that bloat the context window. This inflates API costs and can cause rate-limit denial of service.
Read advisoryPut policy between your agents and the next risky action.
Install Guard locally, connect the tools your team already uses, and review covered actions before they run.