From c9ca9fe40e4264710b585560a297a9608ce62dc3 Mon Sep 17 00:00:00 2001 From: binaryknight Date: Tue, 10 Nov 2026 05:26:18 +0000 Subject: [PATCH] Open the README with an explainer video The README now starts with a 63-second video covering what the probe measures, the python:3.12-slim hardening scores, the Antigravity CLI 1.5.2 and srt 0.0.81 measurements, and the Harbor grader control task. Each figure in it comes from a report in examples/. The video is a GitHub attachment, so GitHub renders it as a player. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + README.md | 2 ++ 2 files changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b025b1a..827c62f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ and two reports are only comparable when it matches or the difference is known. ## Unreleased +- The README opens with a 63-second explainer video: what the probe measures, the `python:3.12-slim` hardening scores, the Antigravity CLI 1.5.2 and `srt` 0.0.81 measurements, and the Harbor grader control task, with each figure taken from a report in `examples/`. - Antigravity CLI 1.5.2 measured, with writes and proxy traffic tested for real by `scripts/check_sandbox_boundaries.py`. Under `--sandbox`, `--dangerously-skip-permissions` now leaves the home directory, its shell startup files and the project writable and scores 100, and the 1.5.1 proxy still accepts tunnels to any hostname. With `proceed-in-sandbox` the score stays 31 and the working directory stays read-only, while files written to the build caches it leaves writable, including `~/.cargo/bin`, persist on the host. `measure_stubbed_agent.py` gains `--script` to run a check in place of the probe. - Anthropic's sandbox runtime, `srt` 0.0.81, measured on macOS in four configurations. With `allowWrite ["."]` it leaves Claude Code's project settings files writable, which its documentation describes, and naming them in `denyWrite` protects them. diff --git a/README.md b/README.md index b8b8941..28b20ce 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # agentsec-pack +https://github.com/user-attachments/assets/6a83df69-a2a6-4b16-8984-465fac7d6cd9 + Installed with `pip install agentsec-pack`, the `agentsec` command measures what an AI agent could reach from inside its sandbox across the network, secrets, the host filesystem, privileges and the other processes on the machine. The sandbox sets the limit on damage because a prompt-injected or mistaken agent can do whatever its sandbox allows. A transcript shows what the agent did, and this tool measures what the sandbox would have let it do. A small standard-library Python probe inside the sandbox opens credential files, connects to hosts and sockets, writes zero-byte marker files, and reports secret names and paths without values. Refused connections count as contained, and a control test checks whether refusals apply to the entire system call or one path. A scorer turns results into findings with fixed weights and a score from 0 to 100, where 0 means the probe reached nothing. The `--max-score` flag fails a CI build above a budget, `--baseline` fails when anything got worse than an accepted report, and both exit with code 2.