agent-harness-defense v0.2.0 adds dual-lattice IFC to block LLM privilege escalation

·1 views

Open-source library agent-harness-defense has released version 0.2.0, introducing a dual-lattice information-flow control engine designed to prevent instruction-privilege escalation in LLM coding agents. The tool acts as an admission layer, evaluating a declared action plan before any change is applied, rather than monitoring a live agent at runtime. Its decision core tracks two independent axes — confidentiality and integrity — so that any action depending on untrusted data sources, such as repository text or tool output, is automatically denied. The release includes an independently reproduced audit that uncovered and fixed a real defect from v0.1, where source labels were incorrectly assigned, allowing escalation to go undetected. Developers note a significant usability gap: the library requires callers to supply an explicit plan of agent actions, and no integration examples for frameworks like LangChain currently exist.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Free AI Bug Triage Bot to Sort Issue Queues Before Human Review

A software maintainer built a lightweight AI triage bot to automatically classify incoming bug reports before any human review takes place. The bot sorts issues into four categories — needs-info, likely-duplicate, no-action, and escalate — using only free AI model access and no paid APIs. Each classification includes a confidence score and a one-line justification, ensuring transparency in the bot's decisions. The system operates on a strict rule: the bot routes issues, but humans make all final calls, and nothing is closed automatically. The developer shared the full script and decision table publicly, encouraging other open-source maintainers to adopt the approach to reduce attention costs from repetitive triage work.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GDPR Updates for 2026: What Startups Must Do Now to Stay Compliant

Search interest in GDPR compliance tools has surged over 250% following viral developer community discussions, signaling growing urgency among startup founders. Upcoming regulatory changes between 2025 and 2026 include a tightened 24-hour data breach notification window, mandatory AI algorithm documentation, and required data portability via JSON-LD and CSV formats. Fines under the revised framework will range from 2% of turnover for minor violations to 4% or €20 million for serious breaches. Startups can choose from commercial compliance platforms such as OneTrust, DataGuard, and TrustArc, with monthly costs ranging from around $129 to $999. Budget-constrained teams can alternatively build a DIY compliance system using open-source tools like Python and FastAPI for as little as $50 per month in infrastructure costs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How API-Driven Ordering Works for Custom Apparel Platforms

API-driven ordering allows businesses to submit complex custom apparel orders — such as embroidered polo shirts across multiple sizes and colors — without any manual intervention, even outside business hours. A valid order payload must include precise elements like artwork file references, exact product SKUs, decoration method and placement, per-size quantity breakdowns, and shipping details including customs fields for cross-border deliveries. Developers must account for common failure modes such as artwork validation holds, inventory conflicts returning 409 errors, and decoration-method incompatibilities that some platforms fail to catch at submission. Despite returning a 200 response, most custom apparel APIs function as submission gates rather than real-time production systems, with order status potentially delayed 12 to 48 hours before moving to production. Emerging pre-validation endpoints now allow integrations to simulate orders and check artwork compatibility or get production timeline estimates before formally committing an order.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A 60-Minute On-Call Playbook for Handling AI-Generated Code Failures in Production

Software teams increasingly ship AI-generated code but rarely have a structured response plan when that code fails in production. A proposed one-page playbook outlines a 60-minute incident response framework specifically for AI-assisted changes. The first step is immediate containment — rolling back the deployment or disabling a feature flag — before any investigation begins. Engineers then capture a snapshot of the original prompt, model output, git diff, and test results to reconstruct the context that was never formally handed off. The playbook concludes with reproducing the failure using a plain model, making a fix-or-revert decision, and documenting the failure mode so future on-call responders inherit useful context rather than silence.

0 comments Read more at DEV Community