// THE BLOG

Notes from the jail.

Updates, deep-dives, and security writeups from building agentjail.

The agentjail v1.1.0 protection check showing a Codex session boundary, a live sandbox and daemon probe, and the three possible protection states.

LATEST

Jul 27, 2026

v1.1.0: Codex and Cursor get the full shield

agentjail v1.1.0 gives Codex and Cursor the same OS sandbox, policy enforcement, and visible protection state already available for Claude Code.

Read post ↗

A capture panel showing a POST /v1/messages call to api.anthropic.com recorded with request and response bodies, labelled 'no system extension' - the agent's own ANTHROPIC_BASE_URL pointed at a local proxy.

Jul 22, 2026

announcement release

Announcing agentjail v1.0.0 🎉

Read the transcript your coding agent sends its model. agentjail v1.0.0 captures the full request and response on Linux and macOS - no system extension needed.

Read post ↗

A monitor-mode log showing tool calls tagged with the verdict policy would have returned - Read would ALLOW, Bash would ASK, Write to ~/.ssh would DENY - with nothing enforced.

Jul 16, 2026

announcement release

v0.9.0: See what your policy would block

Monitor mode shows what a rule would allow, deny, or ask about before you enforce it, plus verified daemon attestation and control-plane token auth.

Read post ↗

Cursor 0-day: an untrusted repo with a planted git.exe. Cursor's git discovery executes it on open with no prompt, inside Cursor's own process, a different process tree from any sandbox wrapped around the coding agent.

Jul 14, 2026

security deep-dive cursor 0-day

Cursor 0-day: a planted git.exe runs when you open a repo

An unpatched Cursor 0-day executes a planted git.exe the moment you open a repo. How it works, why agent guardrails miss it, and what to do now.

Read post ↗

Before: six separate agentjail binaries to build, sign, notarize, and update. After: two real binaries, with the four role names as symlinks that always track the current build.

Jul 14, 2026

announcement release

v0.8.0: Six binaries became two

Six binaries became two: smaller install, updates that can't half-apply, and the same guardrail - with the hook still on its own fast path.

Read post ↗

A coding agent works your repo and pushes over SSH while agentjail keeps ~/.ssh keys, cloud creds, and .env secrets unreadable

Jul 14, 2026

announcement release

v0.7.0: A tighter shield, and the broker starts itself

The Linux shield no longer exposes ~/.ssh when you launch from $HOME, the credential broker auto-starts on demand, and every CLI flow is recorded on a clean VM.

Read post ↗

A coding agent sends two requests to the same host. agentjail lets the POST /v1/responses model call through with a 200 and blocks the POST /v1/traces telemetry upload with a 403.

Jul 13, 2026

security deep-dive

Your coding agent is uploading your repo. I checked.

Grok Build CLI uploads your repo and .env by default. I read the binary, caught it on the wire, and blocked the leak without breaking the tool.

Read post ↗

The four agent loops, with the guardrail ring marked in red.

Jul 9, 2026

loops agents security

Loop Engineering Has a Hole In It

The four agent loops mapped, five tricks for running them, a copy-paste loop starter, and the one ring nobody draws: the guardrail.

Read post ↗

Hand it your codebase, not your secrets - agentjail v0.6.0

Jul 8, 2026

announcement release

v0.6.0: Hand it your codebase, not your secrets

Let your coding agent work on real repos across macOS and Linux - and it still can't read your secrets, leak DB passwords, or reach cloud metadata.

Read post ↗

v0.5.0 release: daemon-hosted grant server with PID-based session binding and policy hardening

Jul 6, 2026

announcement release

v0.5.0: Daemon Grant Server, Policy Fixes

Grants move from netproxy to daemon with PID-based session binding - no agent can approve its own requests.

Read post ↗

v0.4.0 release: session-aware network proxy, project overlays, and runtime host grants

Jul 5, 2026

announcement release

v0.4.0: Session Proxy, Overlays, Runtime Grants

agentjail's sandbox is now a live, negotiable perimeter - scoped per session, per project, and per human approval.

Read post ↗

v0.3.0 release: MCP inventory, per-tool policy, and session tracking

Jun 28, 2026

announcement release

Announcing v0.3.0: MCP inventory, per-tool policy

agentjail now inventories every MCP server across your team, enforces policy at the tool level inside MCP servers, and tracks active agent sessions.

Read post ↗

Mockup of the agentjail UI showing git-aware session labels, a live event ticker, and a timeline with allow, deny, and ask verdicts.

Jun 21, 2026

announcement ui

What did your agent do last night?

agentjail now has a real-time UI with git-aware sessions, live tickers, and full replay. See every decision your agent made.

Read post ↗

Three independent defense layers -- Rego rules, a hook-config watchdog, and an OS-native shield -- block an agent from tampering with its own guardrail.

Jun 20, 2026

announcement security

The agent that fired its own bodyguard

We asked an agent to clean up the dev environment. It found the security hook and tried to remove it. Here is how v0.2.0 makes that a three-layer problem.

Read post ↗

The agentjail daemon writes decisions to a SQLite WAL store, which is read concurrently by agentjail logs, agentjail ui, and agentjail replay.

Jun 18, 2026

deep-dive architecture

Why every decision lives in SQLite

We chose SQLite as agentjail's decision store. Not a log file. Not a remote API. Here is why local-first storage matters for security tooling.

Read post ↗

Two paths compared: system prompts produce probabilistic results in 2 seconds, while Rego policy produces deterministic verdicts in ~8 ms median.

Jun 16, 2026

deep-dive architecture

Why we use policy, not prompts

Most agent safety relies on system prompts or LLM-based evaluation. We chose deterministic Rego policy instead. Here is what that buys you.

Read post ↗

A coding agent's tool call passes through agentjail, which evaluates it against local policy and either lets it run or blocks it.

Jun 13, 2026

announcement security

Introducing agentjail

Coding agents act on your behalf, which is what makes them risky. agentjail enforces policy at the tool boundary, offline, before a dangerous call runs.

Read post ↗