Open-source security plugin 'agent-ledger' adds audit trail and risk scoring for Hermes AI agents

·1 views

Developer ZidoCode has released agent-ledger, a free open-source plugin for the Hermes Agent AI framework. The plugin records every tool call an AI agent attempts to execute in a local SQLite database before it runs. It then analyzes this recorded activity against the OWASP Agentic Top 10 security risks, generating a posture score from 0 to 100. The tool is designed to run entirely offline on a user's machine with no telemetry or external accounts. It specifically detects risks like tool misuse, unexpected code execution, and cascading failures from metadata alone.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Low-code AI platforms Flowise and Dify show significant internet exposure

A cybersecurity scan conducted via ZoomEye on September 28, 2026, identified 40,653 internet-facing instances of Flowise and 10,860 instances of Dify. Both are low-code platforms used to build applications on top of language models. Their web interfaces allow users to assemble workflows using prompts, tools, and data sources, and they store API keys and credentials internally. These platforms are often deployed publicly for evaluation and then kept as production instances, sometimes without authentication enabled. The stored credentials, which can include billable model provider keys and internal document access, make this exposure significant.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New API Aggregates Israeli Used Car Data from Multiple Public Registers

A developer has consolidated disparate Israeli government vehicle information into a unified API tool. The service pulls data from public registries on roadworthiness, recalls, and leasing history, which are normally scattered across multiple Hebrew-language databases. Users can submit a list of license plates to receive a structured vehicle history report through one of two paid Apify Actors. The independent tool does not provide owner identity, accident history, or lien information, as that data is not published by the government.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rotating S3 URLs cause exponential Vercel image optimization costs

A platform team received a billing alert showing their Vercel image optimization usage had surged from a 50,000 monthly limit to 2.3 million source images processed in a single day. The spike coincided with the launch of a new product gallery page, but logs ruled out external scrapers or flawed page rendering as the cause. Investigation revealed the issue stemmed from the use of S3 presigned URLs, which generate a unique date and signature parameter with each request. Vercel's image optimizer treats each unique URL as a new source image, bypassing its cache and causing repeated processing of identical files.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Explaining Why Rust's Compiled Object Files Still Require a Linker

Compiling Rust code produces object files containing machine code and data. The linker is still required to combine these files into an executable, despite the presence of machine code. This is because object files contain unresolved symbols and relocations that reference external functions or data. The linker resolves these references by connecting symbols to their actual addresses. Without linking, the CPU cannot execute the code as these references remain undetermined.

0 comments Read more at DEV Community