Skip to content

content: weekly brief — 2026-05-04 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cloakmaster wants to merge 1 commit into from
Closed

content: weekly brief — 2026-05-04 #22

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
234 changes: 234 additions & 0 deletions content/_briefs/2026-05-04.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,234 @@
# Weekly Content Brief — 2026-05-04

> Generated by the Inkog content routine. For review by Ben before Monday.

---

## Run metadata

| Field | Value |
|---|---|
| Generated | 2026-05-04 (Sunday) |
| Period scanned | 2026-04-27 → 2026-05-04 |
| Atom feeds hit | 6 (splx-ai/agentic-radar, snyk/agent-scan, NVIDIA/garak, Giskard-AI/giskard-oss, msoedov/agentic_security, affaan-m/agentshield) |
| Blog pages hit | 3 (wiz.io/blog, endorlabs.com/blog, lakera.ai/blog) |
| PostHog query | 1 (project 108473, last 7 days) |

---

## 1 — Field scan summary

### OSS competitor releases (last 7 days)

| Repo | Signal | Date |
|---|---|---|
| **NVIDIA/garak** | **v0.15.0** — agent breaker probe, system prompt extraction probe, multi-turn GOAT probe, ModernBERT refusal detector | May 1, 2026 |
| **snyk/agent-scan** | **v0.5.0 + v0.5.1** — two releases in 24 hours, daily commits still landing May 4 | Apr 30 – May 1, 2026 |
| **Giskard-AI/giskard-oss** | **v1.0.0 beta suite** — giskard-llm v1.0.0b2, giskard-agents v1.0.2b2, giskard-checks v1.0.2b2, giskard-core v1.0.1b3 all shipped Apr 29 | Apr 29, 2026 |
| splx-ai/agentic-radar | Last release Nov 2025 — no activity | — |
| msoedov/agentic_security | Last release May 2025 — no activity | — |
| affaan-m/agentshield | Last release Mar 2026 — no activity | — |

### Commercial blogs (last 7 days)

- **Wiz** (Apr 30): "The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2)" — permission bypasses, prompt injection, defenses. Also: "Red Agent and Claude Opus: Securing Production Targets at Scale."
- **Endor Labs** (Apr 27): "GPT-5.5 Sets a New Code Security Record with Cursor" (Agent Security League benchmark). Apr 23: "The agent control plane needs a security layer."
- **Lakera**: Last post October 2025 — appears dormant.

### Inkog repo activity

- **PR #12 merged** (Mar 21): Multi-platform CI/CD templates — GitLab CI, Azure DevOps, Jenkins. SARIF integration for all three. Now the most recently shipped feature.
- **PR #11 closed without merge** (Apr 10): AG2 framework support (from autogen → AG2, autogen_agentchat → AutoGen v0.4). Still an open gap in detection.
- **Open issues generating topic hooks:**
- Issue #3: OpenClaw framework (175K stars, Meta banned, Cisco "security nightmare", 135K+ exposed instances, 15K+ RCE-vulnerable) — no static scanner exists
- Issue #9: EU AI Act expansion — Aug 2, 2026 enforcement, Articles 9/10/11/13 not yet mapped
- Issue #7: OWASP MCP Top 10 mapping — Astrix found 53% of MCP servers use hardcoded credentials, 8.5% use OAuth

### PostHog — last 7 days (project 108473)

**Top pages by visits:**

| Page | Visits |
|---|---|
| / (home) | 38 |
| /scan | 21 |
| /sign-in | 8 |
| /report | 6 |
| /frameworks/dify | 4 |
| /tutorials/prevent-langchain-prompt-injection | 2 |
| /openai-agents-security | 2 |
| /frameworks/llamaindex | 2 |

**Top referrers:** Google (7), LinkedIn (5), inkog.io internal (5), GitHub (1). High direct-traffic share (117) suggests most visitors are coming from word of mouth / newsletter.

**Notable:** /frameworks/dify at 4 visits and /openai-agents-security at 2 — both framework-specific pages performing above their weight. No single page jumped >50% week-over-week (absolute volume too low to trigger that threshold).

---

## 2 — Recent Labs posts (avoided — last 30 days)

1. "The Vercel Breach: Anatomy of an AI Tool Supply Chain Attack" — Apr 21
2. "What 561 Repositories Taught Us About AI Agent Security" — Apr 10
3. "Building Secure AI Agents with Claude Code and the Inkog MCP" — Apr 10
4. "Why Multi-Agent Communication in CrewAI Needs Authentication" — Apr 8

*(Apr 3 post "The AI Agent Security Gap" also noted but >30 days.)*

Topics below do not overlap with any of the above.

---

## 3 — Candidate Labs topics

---

### Topic A

**Working title:** "OpenClaw Has 175,000 Stars, a Cisco Security Nightmare Rating, and No Real Static Scanner — Here's What One Would Catch"

**Hook:** OpenClaw is the fastest-growing open-source AI agent framework: 175K GitHub stars, 400K+ monthly downloads by some estimates, used in production at thousands of companies. Meta banned it internally after their security team's assessment. Cisco's AI Threat Research team published a "security nightmare" analysis. SecurityScorecard scanned the public internet and found 135,000+ exposed OpenClaw instances — 15,000+ of them vulnerable to remote code execution. The one existing open-source scanner (Cisco's Skill Scanner) checks whether an agent's installed skills have been tampered with or are malicious. That's necessary but wildly insufficient: it's equivalent to checking whether your npm packages have malware while ignoring whether your application passes unsanitized user input to `eval()`. The real behavioral security questions — are guardrails configured, are tools least-privileged, are destructive operations gated behind human approval — are unanswered by any existing tooling. Inkog's IR-based approach already handles 21 frameworks. OpenClaw's Markdown configuration format (TOOLS.md, SKILL.md, SHIELD.md, SOUL.md, AGENTS.md) is different from LangGraph's Python or n8n's JSON, but the behavioral patterns are the same. The reader takeaway: here is exactly what an OpenClaw static analysis pass would check, here are the findings we'd expect to see in the wild, and here is where Inkog is on building it.

**Key supporting links:**
- https://github.com/openclaw-ai/openclaw (175K stars)
- https://blogs.cisco.com/security (Cisco AI Threat Research "security nightmare" analysis)
- https://securityscorecard.com/ (135K+ exposed instances, 15K+ RCE)
- https://astrix.security/research/ (OpenClaw/Moltbot risk analysis)
- https://owasp.org/www-project-top-10-for-large-language-model-applications/ (OWASP LLM08: Excessive Agency)

**Suggested length:** Standard (~1,200 words)

**Inkog connection:** Issue #3 in active development — OpenClaw adapter is on the roadmap. This post announces the roadmap item, frames the gap versus Cisco's Skill Scanner (malicious skill detection vs. behavioral static analysis), and positions Inkog as the first tool to cover behavioral patterns in OpenClaw configs. Strong differentiation post: Inkog goes beyond "is this skill infected" to "does this agent have missing oversight, unbounded loops, or over-permissioned tools."

**REJECT if:** We can't show at least 2-3 concrete example findings from real OpenClaw configs. The post needs specifics, not hypotheticals.

---

### Topic B

**Working title:** "EU AI Act Enforcement Is 90 Days Away — The Four Articles Your Agent Team Is Probably Ignoring"

**Hook:** August 2, 2026 is the enforcement date for EU AI Act obligations on high-risk AI systems. Fines reach €35M or 7% of global annual turnover. Most AI agent teams have mapped Articles 14 (human oversight) and 15 (accuracy and robustness) — these have reasonably clear architecture-level analogues. What teams are mostly ignoring: Articles 9 (risk management system), 10 (data governance), 11 (technical documentation), and 13 (transparency). Article 11 is the most immediately auditable by static analysis: does an AGENTS.md file exist, and does it accurately describe what the system does? You can check this with grep. Most production agent repos today fail it. Article 13 asks whether your prompt templates include language identifying the system as AI-powered — again, a static scan across every prompt template in a codebase. Inkog currently maps findings to Articles 12, 14, and 15 under `--policy eu-ai-act`. We're shipping coverage for Articles 9, 10, 11, and 13 before the August deadline. The post walks through each article, shows the concrete code signal Inkog checks, and gives teams a 90-day action checklist.

**Key supporting links:**
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj (EU AI Act full text)
- https://artificialintelligenceact.eu/ai-act-implementation-timeline/ (enforcement timeline)
- https://www.nist.gov/artificial-intelligence/ai-risk-management-framework (NIST AI RMF crosswalk)
- https://github.com/inkog-io/inkog/issues/9 (tracking issue with article-to-detection mapping table)

**Suggested length:** Deep dive (~2,500 words)

**Inkog connection:** `--policy eu-ai-act` preset already ships. This post is the authoritative guide to what that preset covers today, what's coming before Aug 2, and how to use it as a pre-audit readiness check. Strong lead-gen for EU teams — the post can end with "run `inkog -path . --policy eu-ai-act` and share your report with your compliance team."

---

### Topic C

**Working title:** "GARAK v0.15.0 Added an Agent Breaker Probe — What It Finds Dynamically vs. What Inkog Finds at Commit Time"

**Hook:** NVIDIA's GARAK shipped v0.15.0 on May 1 — three days ago. Headlining additions: an agent breaker probe designed to "test tools available to target systems," a system prompt extraction probe, and a multi-turn GOAT probe for sustained adversarial testing. GARAK is the most comprehensive dynamic red-teaming framework for LLMs and agents. Its new probes are genuinely interesting. But dynamic testing has a structural limitation: you can only break what you've already deployed. The agent breaker probe finds that a deployed agent's tools are exploitable. Static analysis — run at code-review time — finds that the tool definitions lack authorization checks, that the agent configuration has no rate limits, that the prompt template is trivially injectable. These are the same vulnerabilities, caught at different points in the pipeline. Snyk shipped Agent Scan v0.5.0 and v0.5.1 in the same 24-hour window. Giskard shipped a full v1.0.0 beta suite across four packages on April 29. Three major agent security releases in one week is a signal. The post maps GARAK v0.15.0's new probes to the corresponding Inkog static findings, argues that the tools belong in different CI stages rather than being alternatives, and shows what the combined pipeline looks like.

**Key supporting links:**
- https://github.com/NVIDIA/garak/releases/tag/v0.15.0 (GARAK v0.15.0 release notes)
- https://github.com/NVIDIA/garak (GARAK repo, v0.15.0 merged May 1)
- https://github.com/snyk/agent-scan/releases (Snyk Agent Scan v0.5.0 + v0.5.1, Apr 30–May 1)
- https://github.com/Giskard-AI/giskard-oss/releases (Giskard v1.0.0 beta suite, Apr 29)

**Suggested length:** Standard (~1,200 words)

**Inkog connection:** Concrete probe-to-finding comparison table. GARAK's agent breaker probe tests tool exploitability at runtime → Inkog's `excessive_agency` and `missing_authorization` findings catch the same issue at scan time. GARAK's system prompt extraction probe → Inkog's prompt injection surface detection. Positions Inkog as the shift-left complement to GARAK, not a competitor. Strong for developer audiences who already know and respect GARAK.

---

## 4 — LinkedIn drafts

---

### LinkedIn 1 — OpenClaw

OpenClaw now has 175,000 GitHub stars. Meta banned it internally. Cisco's threat research team published an analysis calling its default configuration "a security nightmare." SecurityScorecard found 135,000+ exposed instances — 15,000+ vulnerable to remote code execution.

The only open-source scanner for OpenClaw (Cisco's Skill Scanner) checks whether an agent's installed skills are malicious. Necessary, but it doesn't check whether guardrails are configured, whether tools are scoped to least privilege, or whether there's a human approval gate before the agent deletes files or sends emails.

Static analysis for OpenClaw needs to examine behavioral patterns — the same class of vulnerabilities Inkog already catches across 21 other frameworks. We're building it.

What would you check first in an OpenClaw project if you had no tooling and 30 minutes?

---

### LinkedIn 2 — EU AI Act

The EU AI Act enforcement date for high-risk AI systems is August 2, 2026 — 90 days from now. Most teams I've spoken with know Articles 14 and 15 (human oversight and accuracy). Articles 9, 10, 11, and 13 are where the real gaps are.

Article 11 — technical documentation — is the most checkable by static analysis today: does an AGENTS.md file exist, and does it accurately describe what the agent actually does? That's auditable right now with no specialized tooling. Most production repos don't have it.

Inkog's `--policy eu-ai-act` currently maps to Articles 12, 14, and 15. We're shipping 9, 10, 11, and 13 coverage before August. Not legal advice — just concrete code signals that reduce your gap before an audit.

Which article are you least confident about for your current deployment?

---

### LinkedIn 3 — GARAK v0.15.0

GARAK v0.15.0 shipped May 1 with three notable additions: an agent breaker probe that tests tools available to deployed systems, a system prompt extraction probe, and a multi-turn GOAT probe for adversarial testing. If you're doing AI red-teaming, this release is worth the upgrade.

Dynamic testing and static analysis solve different problems in the same pipeline. GARAK tests what you've deployed. Static analysis — Inkog — finds the same issues at code-review time: unbounded tool exposure, missing authorization gates, injectable prompt templates. These are detectable in the diff, not just in production.

Same week: Snyk shipped Agent Scan v0.5.0 and v0.5.1, Giskard shipped a full v1.0.0 beta suite. Three major agent security releases in one week is a market signal worth paying attention to.

Which stage of your CI pipeline is currently the weakest link for agent security?

---

## 5 — Twitter threads

---

### Thread 1 — OpenClaw

**1/** OpenClaw: 175K GitHub stars. Meta banned it. Cisco called it "a security nightmare." 135K+ exposed instances on the public internet. 15K+ vulnerable to RCE. And there's no real static security scanner for it. Thread. ↓

**2/** Cisco released a "Skill Scanner" for OpenClaw. It checks whether installed skills are malicious — like checking whether your npm packages are infected while ignoring whether your code passes user input to eval(). Necessary. Not sufficient.

**3/** What static analysis of an OpenClaw project actually needs to check:
— Does SHIELD.md (guardrails) exist?
— Are tool definitions scoped to least privilege?
— Is there human approval before destructive ops (file delete, email send, API calls)?
— Are tool descriptions injectable via user-controlled input?

**4/** OpenClaw config is Markdown-based: TOOLS.md, SKILL.md, SHIELD.md, SOUL.md, AGENTS.md. Different format from LangGraph's Python or n8n's JSON. Same behavioral patterns: missing oversight is missing oversight regardless of which file it's declared in.

**5/** The gap isn't OpenClaw-specific. It's what happens every time adoption outpaces tooling. LangChain in 2023. CrewAI in 2024. OpenClaw now, at a bigger scale. 175K stars means a lot of production agents without a proper pre-flight check.

**6/** We're building OpenClaw support in Inkog — first framework using Markdown config files, same IR underneath. Missing oversight finding looks the same whether it comes from a LangGraph Python file or a SHIELD.md.

**7/** If you're running OpenClaw in production today: what's your current security check? Genuinely curious what people are actually using.

---

### Thread 2 — EU AI Act 90-day warning

**1/** EU AI Act enforcement for high-risk AI systems: August 2, 2026. 90 days. Fines up to €35M or 7% of global turnover. Let's talk about what this actually looks like in code — not legal theory, just the static signals. ↓

**2/** Most teams have mapped Article 14 (human oversight) and Article 15 (accuracy/robustness). These are the documented ones. Articles 9, 10, 11, and 13 are where I see teams consistently underprepared.

**3/** Article 11 — technical documentation — is the most immediately checkable. Does your AGENTS.md exist? Does it match what the agent actually does? You can literally grep for this. Most production repos fail it. It's also the one auditors will notice immediately.

**4/** Article 13 — transparency — means your prompt templates need to identify the system as AI-powered. Static analysis can scan every prompt template in your codebase for the absence of this. Most don't have it. Easy to add, easy to forget.

**5/** Article 9 — risk management — maps to things security scanners already check: rate limits, resource bounds, audit logging. You may be more ready here than you think. The gap is usually documentation of the assessment, not the controls themselves.

**6/** What none of us can tell you: whether your specific system qualifies as "high-risk" under the Act. That's a legal determination. What static analysis CAN tell you: here are the code-level gaps between your current state and what an auditor would look for.

**7/** 90 days. Which article is your team least confident about? The answer I hear most often is 11 — but it varies a lot by deployment context.

---

## Skipped

- **Wiz GitHub Actions post (Apr 30)** — Permission bypasses and prompt injection in AI-powered GitHub Actions. Interesting but overlaps directionally with the Vercel supply-chain post (Apr 21) that already ran. Save for a future CI/CD-specific angle once that topic has cooled.
- **Endor Labs Agent Security League** — Benchmarking AI coding agents by security outcome. Genuinely interesting but Inkog's angle would be weak here (we're a static scanner, not a coding agent). Pass.
- **Giskard v1.0.0 beta architectural split** — Shipping giskard-llm, giskard-agents, giskard-checks, giskard-core as separate packages signals a maturity move. Worth watching but no compelling Inkog hook this week.
- **splx-ai/agentic-radar** — No releases since Nov 2025. Skipped.
- **msoedov/agentic_security** — No releases since May 2025. Skipped.
- **affaan-m/agentshield** — Last release Mar 2026, no recent activity. Skipped.
- **Lakera blog** — Dormant since Oct 2025. Skipped.
Loading