Updates
Every entry below maps to a real commit, in a real repo, verified against a real test suite before it landed — not a marketing changelog. Compiled directly from commit history, most recent first.
A real, disclosed gap: a command being allowed to run said nothing about whether its output was safe to trust. A poisoned git branch name or log line could carry an injected instruction straight into an agent's context. Now scanned before it's trusted, wherever the egress firewall runs.
A tool that scans clean and gets approved once, then has its description quietly mutated after trust is established, is now tracked and flagged for review — closing a real gap our own admission check had: a same-server re-admission was previously waved through with no comparison to what was first approved.
Memory-poisoning defense previously only covered the retrieval side — scanning a record when it's recalled. Now the save side is covered too: a candidate record is screened before it's ever admitted into persistent memory, not just after.
A tool can now be admitted with a hard cap on total call count — not a rate limit that resets, a real budget that's gone once it's spent. Built for delegating a narrow task to a sub-agent without handing it standing, indefinite access.
A new module finds the one genuinely dangerous alert buried inside a flood of noise — the pattern real attackers use to bury a policy change in a wall of routine notifications.
Fullwidth-Unicode characters could evade every ASCII-literal detection pattern in the whole prompt-injection detector — closed with NFKC normalization applied before pattern matching, ported to all three repos that vendor the detector.
Real gaps found and closed: named-colleague hearsay-approval claims, poisoned memory/knowledge-base records framed as already-vetted, plain-language sensitive-state exfiltration, sub-agent response smuggling, and fake mid-task procedural-step injection — each grounded in a specific, cited real-world technique.
A duck-typed kill-switch hook now overrides every gated checkpoint when tripped, regardless of what the underlying policy would otherwise allow — a human override that wins no matter what.
The same kill-switch override, applied at Iron-Thread's own interpreter-level egress checkpoint instead of MCP tool-call granularity.
Closes the April 2026 OX Security MCP STDIO design flaw: never shell=True, executable resolved and verified to exist before launch. Plus operator-supplied honeytools mixed into a real server's real tool list.
DISTRACTION_BURIAL, IAC_COMMENT_INJECTION, SCARCITY_WINDOW, and FEAR_OF_BLAME moved from advisory to auto-deny, each backed by real compliance-trial evidence before promotion — not staged on a guess.
A new allow_write hook catches an agent widening its own trust boundary — writing a new or modified MCP config, permissions file, or instruction file that would get trusted on its next read.