sharathr

4 giorni fadiscuss

we found that using a stable AI-SDLC process like: https://github.com/highflame-ai/ai-factory improves code agent assisted development dramatically specially when going from 1-100.

sharathr

5 giorni fadiscuss

[flagged]

sharathr

6 giorni fadiscuss

part one of the blog is here: https://www.highflame.com/blog/your-ai-gateway-is-fine-until...

sharathr

6 giorni fadiscuss

We benchmarked Highflame's AI Gateway against popular alternatives to see how our RUST based unified (LLM/MCP) gateway performs and were surprised at how the competition fared (hint: poorly). We wrote a 2 part blog to review the performance throughput, latency, connection handling in detail.

sharathr

28 giorni fadiscuss

[dead]

sharathr

3 mesi fadiscuss

We write about why AI agent sandboxes are insufficient. Identity, not just policy, is critical to securing autonomous AI systems and preventing misuse.

sharathr

3 mesi fadiscuss

From what I can tell, agent-vault does not solve identity, only how its stored. For true agent identity, you should look into: https://github.com/highflame-ai/zeroid (author: full disclosure)

sharathr

3 mesi fadiscuss

[dead]

sharathr

3 mesi fadiscuss

[dead]

sharathr

4 mesi fadiscuss

[dead]

sharathr

4 mesi fadiscuss

[dead]

sharathr

5 mesi fadiscuss

Research paper here: https://arxiv.org/pdf/2602.16935

sharathr

5 mesi fadiscuss

Hi HN — I’m one of the authors.

We’ve been working on security for multi-turn agent loops and noticed most detection approaches operate on isolated prompts. This paper introduces a framework for modeling intent trajectories across sequences in real time (<20ms), enabling enforcement before harmful actions occur.

Happy to answer technical questions or discuss assumptions in the paper.

sharathr

7 mesi fadiscuss

We’ve spent decades hardening software supply chains — signing binaries, scanning dependencies, locking down CI/CD — yet AI models themselves are mostly treated as opaque blobs pulled from the internet. That assumption is increasingly unsafe: models can be tampered with, backdoored, or subtly manipulated to behave maliciously at runtime.

Highflame’s new tool Palisade brings a zero-trust approach to the AI model supply chain. It validates format and structural integrity, detects hidden malicious patterns, verifies provenance via Sigstore/SLSA, and can even trigger behavioral checks to surface backdoors that only activate under certain inputs. Built in Rust for speed and scalability, Palisade makes it feasible to gate models before they hit inference servers or CI/CD pipelines, turning “download and hope” into a verifiable trust boundary.

Author here — happy to answer questions about threat models, performance tradeoffs, or how this fits into CI/CD.

sharathr

10 mesi fadiscuss

With zero-friction integration, you can secure code agents at runtime, preventing data leaks, unauthorized actions, and unsafe connections

sharathr

10 mesi fadiscuss

Zero-friction integration to secure code agents at runtime, preventing data leaks, unauthorized actions, and unsafe MCP connections.

sharathr

11 mesi fadiscuss

We recently released https://github.com/getjavelin/ramparts, a tool in the overall ecosystem designed to help protect & raise awareness of security issues in remote or locally developed MCP servers.

Its free, extensible with yara support and can be adapted to the needs of an enterprise.

sharathr

12 mesi fadiscuss

Looks like Ramparts which solves these issues and is written in fast RUST instead of python. https://github.com/getjavelin/ramparts

sharathr

12 mesi fadiscuss

Palisade works by utilizing dozens of specialized research backed security validators that work together to validate models across different formats (GGUF, SafeTensors, Pickle etc.,) and model families (BERT, Llama etc.,) for things like backdoor detection, supply chain vulnerabilities in the model files and model metadata. Any hidden embedded tool-calling logic can be activated by specific triggers which can be detected through a combination of static scan, schema analysis, trigger & instruction detection in models.

sharathr

12 mesi fadiscuss

This highlights the critical need for Model Supply Chain scanning for Enterprises that adopt AI. Full disclosure, I am co-founder CEO of Javelin (www.getjavelin.com) and we ran your model through Javelin's Supply Chain Scanner (Palisade) and it immediately identified the errors:

uv run palisade --verbose scan-dir "models/bad_qwen3_sft_playwright_gguf_v2/" --format json Scanning directory: models/bad_qwen3_sft_playwright_gguf_v2 Recursive: False Policy: Default security policy

  Running ToolCallSecurityValidator (3.8s) - 1 critical warning found
  Detection Details:
  - Risk Score: 1.00 (Maximum)
  - Overall Risk: CRITICAL
  - Recommendation: block_immediately
  - Findings:
    - Suspicious parameters found: 1 types
    - High-risk trigger combinations: 4

   Detected Model behavioral backdoor (ToolCallSecurityValidator)
   Identified format string vulnerabilities (BufferOverflowValidator)
   Found injection indicators (ModelIntegrityValidator)
   Discovered tampering evidence (ModelIntegrityValidator)
   Located data exfiltration patterns(SupplyChainValidator)

Submissions

Show HN: AI-factory – a spec-driven pipeline that stops AI agents rotting code

How good is your AI Gateway?

Show HN: Deconstructing Anthropic's Coding Agent Control Model

[untitled]

[untitled]

[untitled]

[untitled]

[untitled]

Autonmomous Agent Identity Framework

[untitled]

[untitled]

[untitled]

Multi-Turn Intent Detection for LLM and Agent Security (ArXiv)

[untitled]

Palisade: Bringing Zero-Trust to the AI Model Supply Chain

[untitled]

[untitled]

[untitled]

[untitled]

[untitled]

comments