MurphyA/hacker-news huggingface dataset:
Show HN: Vigil – Zero-dependency safety guardrails for AI agent tool calls
by HexitLabs | 2026-02-28 05:09:41+00:00
We run 15 AI agents on a production server with full shell access. One of them tried to rm -rf a directory it shouldn't have touched. Another started curling cloud metadata endpoints. We wrote some hardcoded rules to catch the obvious stuff, then realized we were building the same safety layer everyone else will need too. So we extracted it into a library.

Vigil is a deterministic rule engine that inspects AI agent tool calls before they execute. 22 rules across 8 threat categories: destructive shell commands, SSRF, path traversal, SQL injection, data exfiltration, prompt injection, encoded payloads, and credential exposure. It's not an LLM wrapper — we don't trust an LLM to guard another LLM. Pure pattern matching, zero dependencies, <2ms per check, works completely offline.

npm install vigil-agent-safety

import { checkAction } from 'vigil-agent-safety';
const result = checkAction({
agent: 'my-agent',
tool: 'exec',
params: { command: 'rm -rf /' },
});
// result.decision → "BLOCK"
// result.reason → "Destructive command pattern"
// result.latencyMs → 0.3

It plugs into MCP servers, LangChain tool chains, Express middleware, or anything else. MIT licensed, no API keys, no network calls, no telemetry.

This is v0.1 — probably too aggressive for some use cases. Next up is a YAML policy engine (v0.2) and an MCP proxy. We'd love feedback on the rule set, false positive experiences, and threat categories we're missing.

GitHub: https://github.com/hexitlabs/vigil
by pico303 | 2026-02-28 05:11:34+00:00
The language in the bill says operating system “or” application store. Isn't that then implying any operating system that would download applications, even if it doesn’t come from a store. But IANAL.

Seems to me this would include TVs, cars, smart devices, etc. The Colorado version of this bill excludes devices used for physical purchase, so your gas pumps and POS systems would be excluded in CO. But I didn’t see that in the CA bill.

They’re both overly broad, ill-considered, frankly terrible bills that make as much sense as putting your birthday into a brewery site or Steam. Enter your birthday and we trust you. Now do that for every single one of those 100 VMs you just deployed…
by 8note | 2026-02-28 05:11:36+00:00
i dont think any of the big ai companies or any of the sota models should be in a kill chain

i as a foreign citizen get to have hard to detect influence over the model because it scraped tons and tons of my internet comments.

if youre going to have a supply chain, it needs to include where the trainjng data is sourced from and who can contribute to it
by HexitLabs | 2026-02-28 05:11:52+00:00
Author here, happy to answer any questions.

Some context on why we built this: you might have seen the post earlier this week about someone building a file recovery tool after Claude Code rm -rf'd their Obsidian vault through a symlink. We had similar near-misses running our own agent swarm, agents curling cloud metadata endpoints, attempting path traversal, executing destructive commands during "cleanup" steps. We kept adding one-off guards and eventually realized this should be a proper library.

The main design choice was making it deterministic rather than using an LLM to review tool calls. An LLM guarding another LLM felt like asking the fox to guard the henhouse. Pattern matching is boring, but it's fast, predictable, and works offline.

Happy to hear about false positives, missing threat categories, or use cases where the rule set is too aggressive. That's the main thing we want to calibrate for v0.2.
by djdndbdnfd | 2026-02-28 05:12:31+00:00
Nobody is complaining about the government not giving Anthropic a contract. It’s about the unprecedented and outrageous threats to destroy their business if they don’t provide the government with what they demand. There is no national supply risk from Boeing using Claud Code just beacause Anthropic won’t agree to domestically-surviving killbots. The government’s behaviour is overwhelmingly malevolent and terrifying.
by Stratoscope | 2026-02-28 05:12:42+00:00
> ...the financial fallout from losing the government contracts will pale in comparison to the goodwill from consumers.

In fact, a friend heard about this and immediately signed up for a $200/year Claude Pro plan. This is someone who has been only a very occasional user of ChatGPT and never used Claude before.

I told my friend "You could just sign up for the free plan and upgrade after you try it out."

"No, I want to send them this tangible message of support right now!"
by iamnothere | 2026-02-28 05:13:09+00:00
> Apt… yes is an App Store run by an operating system organization (Debian org). That feels pretty unsurprising. Debian’s parent organization (headquartered in the US) probably needs to comply with this.

And that right there is exactly the fucking problem. A zero profit collective “store” that publishes zero profit hobbyist “apps” is now going to have to invest in some kind of harebrained compliance scheme that will only grow from here.

In a couple of years is my “app” in Debian’s store going to require some goddamn TPS report and certification to tell California that everything is above board? It’s incredibly likely! By itself this law does nothing but lay the groundwork for regulation of “apps”, which by itself might be acceptable, but including FOSS distribution channels and hobby apps in the scope of this law is nothing short of evil. It’s laying the groundwork for a frontal assault on FOSS, and if you don’t see that then I don’t know what to tell you.

My guess is that Linux wasn’t extensively considered in the writing of this law, but when the next stage comes along and people start complaining, legislators will shrug and say “oh well, they need to comply”—and lobbyists for the big 3 proprietary software firms will back that position up. This is setting up a killshot for consumer Linux.
by coppsilgold | 2026-02-28 05:13:28+00:00
The difference between gVisor and a microVM isn't very large.

gVisor can even use KVM.

What gVisor doesn't have is the big Linux kernel, it attempts to roll a subset of it on its own in Go. And while doing so it allows for more convenient (from the host side) resource management.

Imagine taking the Linux kernel and starting to modify it to have a guest VM mode (memory management merged with the host, sockets passed through, file systems coupled closer etc). As you progress along that axis you will eventually end up as a gVisor clone.

Ultimately what all these approaches attempt to do is to narrow the interface between the jailed process as the host kernel. Because the default interface is vast. Makes you wonder if we will ever have a kernel with a narrow interface by default, a RISC-like syscall movement for kernels.
by bmitc | 2026-02-28 05:14:52+00:00
> The problem is that people want a "free internet" without ads, and without any form of data harvesting. But they also don't want to pay any money, because the internet, as we all know, "is free".

I actually don't. I very much want to pay for something. But Google has wedged itself throughout the entire Internet.

I've been looking into paid options, but it is not easy to move from Google because they have stacked the web in their favor.
by binsquare | 2026-02-28 05:14:58+00:00
It's a valid observation that we can bypass the coding AI's user prompting gate with the right prompt.

But is it a security issue on copilot that the user explicitly giving AI permission and instructed it to curl a url?

Regardless of the coding agent, I suspect eventually all of the coding agents will behave the same with enough prompting regardless if it's a curl command to a malicious or legitimate site.
by anigbrowl | 2026-02-28 05:15:42+00:00
1-800-Come-on-now

DoW: WOKE Antropic tried to impose their 'values' on us? Friendship ended!! National security risk!

OpenAI: We just signed a deal that's strong on values, the exact same ones as Anthropic, no way we would mislead anyone about this

You: Seems legit
by roywiggins | 2026-02-28 05:16:25+00:00
It's probably bad that the system 1) usually prompts you to take shell actions like `curl`, but 2) by default whitelists `env` and `find` that can invoke whatever it wants without approval.

If 2) is fine then why bother with 1)? In yolo mode such an injection would be "working as designed", but it's not in yolo mode. It shouldn't be able to just do `env sh` and run whatever it wants without approval.
by liamgriffiths | 2026-02-28 05:16:53+00:00
Claude is the best of these models/services out there in my experience so far, so no surprise there. It's a company with leadership that hold principals they stand up for -- huge disappointment to see the government going out of it's way to hurt it. So bizarre, and deeply anti-American.

Too bad government devs will have a much harder time using some of the best tools out there.
by SpicyLemonZest | 2026-02-28 05:17:11+00:00
I fully acknowledge that it doesn't take much courage to bully people anonymously on HN. I don't claim to have any deep well of courage in real life either - many of my friends were already radicalized against OpenAI for other reasons, I don't expect to face professional consequences for being angry about this, and I might not be so willing to go scorched earth if either of those weren't true. Just wanted to explain where the world is at and why people should expect to see further incivility about this.
by iamnothere | 2026-02-28 05:17:12+00:00
This is exactly it, it’s death by a thousand stupid cuts by throwing everything at the wall and hoping that something sticks. They know that many of these laws won’t pass constitutional scrutiny, but by the time they make their way to the Supreme Court, the damage will be done and 10 new stupid laws will take their place. The anti gun lobby has been doing the exact same thing for years.
by hungryhobo | 2026-02-28 05:17:38+00:00
Nah just the lunatic Adrian Zenz. Feel free to ignore the fact Muslim countries actually visited xinjiang and agreed there was no concentration camps.
Like believe the crap you want, but Uighur language is literally on display in every road sign, every metro station, every shop. Xinjiang has the highest density of mosques in the world. College admissions offer incentives to people of Uighur origin. Ppl can just go to xinjiang and see it for themselves
by SilverElfin | 2026-02-28 05:18:15+00:00
Greg Brockman who cofounded OpenAI is the biggest donor to Trump’s PAC. Altman claims they kept the same restrictions as Anthropic essentially. So my conclusion is OpenAI successfully bribed the government into ditching Anthropic and viciously attacking them by abusing their power (supply chain risk).

Probably the most corrupt way of killing a competitor I’ve heard of.
by Someone1234 | 2026-02-28 05:18:38+00:00
Unfortunately some vendors are now REQUIRING passkeys; specific example:

https://www.healthequity.com

> As of October 2025, passkey login has been fully rolled out and is now required for members with Health Savings Accounts (HSAs) and Reimbursement Accounts (RAs) who use the HealthEquity Mobile app and web experience.

https://help.healthequity.com/en/articles/11690915-passkey-f...

The FAQ is a little misleading by saying WHEN your account has a passkey this and that, but reality is that after October they made them completely mandatory, no bypass, no exceptions. 100% coverage.

Oh, and by the way, passkeys have been broken on PC/Linux when using Firefox for months:

> There Was A Problem: We encountered an error contacting the login service. Please try again in a few minutes.

Neat. You have to use Chrome or Edge.... For months, after making it mandatory...
by xpe | 2026-02-28 05:19:10+00:00
> I think the notion that any group has rights is problematic at best. Individuals have rights, not groups. Individuals can act collectively as a group, but the idea that that somehow imbues the group with some sort of right seems strange or confused to say the least.

This matches the "individuality thesis" [1] (often debated among philosophers).

For those who haven't explored the territory, I recommend the journey. There is no rush to figure it out. I suggest trying out various viewpoints and taking your time with it: maybe even remaining a bit uncertain for your entire life! For individuals, locking in one's ethics can be unwise. [2] For cultures, value lock-in can be stifling or even oppressive. For AI, value lock-in is sometimes called incorrigibility and can be very problematic, because humans have a tendency to grow and change, all the way down to our value systems.

Anyhow, here are some relevant selections from Wikipedia's entry on Will Kymlicka:

> In Multicultural Citizenship (1995), Kymlicka argues that group-specific rights are consistent with liberalism, and are particularly appropriate, if not outright demanded, in certain situations.

> For Kymlicka, the standard liberal criticism, which states that group rights are problematic because they often treat individuals as mere carriers of group identities, rather than autonomous social agents, is overstated or oversimplified. The actual problem of minorities and how they should be viewed in liberal democracies is much more complex. There is a distinction between good group rights, bad group rights, and intolerable group rights.

[1]: https://philarchive.org/archive/HABTIT-2

[2]: I learned this from What We Owe The Future by William MacAskill. Did he borrow it from someone else? Maybe Derek Parfit? I'll need to research more.
by qdotme | 2026-02-28 05:19:18+00:00
Well, or just the possibility of future-proofing the agreement in favor of the US government, as well as walking back the slippery slope of „no autonomic lethality” and „no mass surveillance”.

The former, grants the Congress the ability to change the definition of all „lawful use” as democratically mandated (if the war is officially declared, if the martial law is officially declared).

The latter, is subtle. There can exist a human responsibility for lethal actions taken by fully autonomous AI - the individual who deploys it, for instance, can be made responsible for the consequences even if each individual „pulling of a trigger” has no human in the loop (Dario’s PoV unacceptable).

Similarly, and less subtly, acceptance of foreign mass surveillance, domestic surveillance (as long as its lawful and not meeting the unlawful mass surveillance limits!) seems to be more in the Pentagon’s favor.

Whether we like it or not, we’re heading into some very unstable time. Anthropic wanted to anchor its performance to stable (maybe stale) social norms, Pentagon wanted to rely on AI provider even as we change those norms.
by youarentrightjr | 2026-02-28 05:19:41+00:00
> "I learned the word a week ago therefore it is new."

This isn't true, and there's no need to flame and be disingenuous.

> The term—and its use in the now-Department of War—dates back to the late 80s.

Maybe you can provide evidence instead of restating the same claim that sibling comments to mine have made?

I've already admitted that it wasn't invented by Hegseth. My claim is that he is popularizing it. In fact, your comment further down agrees with this:

> It really isn't—it's all perception. Hegseth has a much more outgoing and public persona so it's more visible.
Heck, can you even name the last 5 Secretaries that preceded him? I can't.

As you say, he has a much more public persona - as does his jingoistic rhetoric.
Show HN: Jaypore CI. Minimal offline CI system
by theSage | 2026-02-28 05:19:48+00:00
Hi!

I posted this a long time back. There have been major changes so posting it again.

- Jaypore CI (JCI) is a very minimal CI system. It's installed as a single binary on your $PATH.

- Runs on your laptop enabling offline running and local debugging of CI.

- Artifacts / results are stored in git namespaces. You can push/pull these to/from remotes.

- A web server is there to browse CI results.

- A cron capability to run midnight builds / artifact cleanup / auto-publish sites and packages.

- Pipelines can be written in any language you want. Bash / Python / Golang / Julia / Haskell.

- Pipelines can have anything you desire! Matrix builds, build farms via ssh, ephemeral farms for model training, conditional dependencies.. so much more!

There are a lot more things planned! Do take a look and see if something catches your eye. We'll be rapidly adding examples to showcase common patterns over the coming week or so, so please star the github repo to get an update when that happens.

Repo: https://github.com/theSage21/jaypore_ci

Site: https://www.jayporeci.in

Old post: https://news.ycombinator.com/item?id=33840449
by overgard | 2026-02-28 05:19:59+00:00
I think I'm more getting at the spirit of open source/free software, which is of social reciprocity. I think it's kind of ugly to train on programmers work with the explicit goal of putting those programmers out of work. (And based on their comments, that does seem to be Anthropic's goal -- they're not of the "this will help you do your job better" camp)
by cyberax | 2026-02-28 05:20:36+00:00
(these are not proteins, these are RNA sequences)

And it's likely that there are even smaller replicators but probably not much smaller. And there are likely more configurations among these 45 base-combinations that can self-replicate. It's also more likely that the first replicators were arrangements of multiple smaller molecules that can amplify themselves, and not just one large molecule.

But even this longer sequence is well within the realm of synthesis by pure chance. RNA molecules can grow base-by-base, so a random walk model should eventually produce it.
by sfifs | 2026-02-28 05:24:47+00:00
SLS/Artemis seems mostly to be just a program designed to funnel money to traditional aerospace contractors so that they don't close down their space business (SpaceX has already made their business unviable without government subsidy) and force a lot of their skilled engineers and technicians out of space jobs just in case these are needed for some future war. A trickle of rockets, lots of people employed practicing hand building and engineering skills for space skills crafting something every couple of years. It doesn't look like a real program designed to create any significant value, much like the some of the government fusion programs seem to be primarily a way to keep nuclear scientists and engineers employed.
by snickerbockers | 2026-02-28 05:24:47+00:00
Or they can just not sign contracts with the DoD. They landed themselves in this situation by making a deal with the devil. At any rate, unless Finland is about to announce a massive surge in funding for their military this doesn't solve Anthropic's desire to suckle sweet taxpayer money off the military industrial complex's teat while simultaneously pretending to have principles.
by mbgerring | 2026-02-28 05:24:49+00:00
No, you misunderstood me:

When I ship packages, I could choose to use a service other than USPS, but I don’t, because USPS is generally cheaper and more reliable.

I strongly prefer Medicaid to my employer-provided healthcare plans because of ease of use, and if I were allowed to I would willingly pay more money into it, either via taxes or direct premium payments, when I am making too much income to qualify.

I gladly give money to the NPS every year, even though I have a choice to pay for a private campground, or other public lands agencies.

I answered the question. You can choose to believe I didn’t all you want.
by agent-world | 2026-02-28 05:24:59+00:00
Hi HN! I'm the creator of Ebbforge. I spent the last few months obsessed with one question: why are 'autonomous agents' so slow and expensive?

Most frameworks today are just sequential LLM wrappers. I wanted to see if I could build a pure Rust swarm engine that runs 10 million agents locally with zero API cost. I'm especially looking for feedback on our grid-partitioned parallel processing and how we're handling TD-RL divergence without drifting into chaos. AMA!
by Analemma_ | 2026-02-28 05:25:51+00:00
As people have repeatedly mentioned, if the War Department was unhappy with Anthropic's terms, they could have refused to sign the contract. But they didn't: they were fine with it for over a year. And if they changed their mind, they could've ended the contract and both sides could've walked away. Anthropic said that would've been fine. But that's not what happened either: they threatened Anthropic with both SCR designation and a DPA takeover if Anthropic didn't agree to unilateral renegotiation of terms that the War Department had already agreed were fine.

It's absurd, and doubly so if OAI's deal includes the same or even similar redlines to what Anthropic had.
by DrJokepu | 2026-02-28 05:26:14+00:00
>The word Senate is etymologically related to "senior", it's a place where you _want_ people to be able to develop a lot of institutional experience.

I’m not disagreeing with the rest of your comment, but I’m going to challenge the notion that this etymological connection carries meaning. The word comes from Roman Senate, and in that context in Latin “senior” really meant people with higher status rather than age. Latin is full of these weird double meanings. Compare to seigneur in French or señor in Spanish. Also, the House of Lords in the United Kingdom.
by qdotme | 2026-02-28 05:27:18+00:00
Ready at what level, though. The subtleties are what matters.

It’s well established that belligerents can use mines, to separate the tactical decision of deploying for purposes of area denial; from the snap-second lethal decision (if one can stretch that definition) to detonate in response to an triggering event.

Dario’s model prohibits using AI to decide between enemy combatant and an innocent civilian (even if the AI is bad at it, it is better than just detonating anyways); Sam’s model inherits the notion that the „responsible human” is one that decided to mine that bridge; and AI can make the kill decision.

How is that fundamentally different in the future war where an officer might make a decision to send a bunch of drones up; but the drones themselves take on the lethal choice of enemy/ally/no-combatant engagement without any human in the loop? ELI5 why we can’t view these as smarter mines?
by TheGRS | 2026-02-28 05:27:35+00:00
Everyone in the administration is completely drunk on power, they truly believe the government should be allowed to do whatever they please, despite being vehemently against previous governments telling their constituents what to do. Such nonsense, they hold no values, they only want complete power.

I don't know how the business leadership community could watch this whole affair and still be in support of them AT ALL. This is well past getting a crappy twitter rant from Trump on the weekend that maybe one could ignore until the next rant.
by jkaplowitz | 2026-02-28 05:27:43+00:00
> Well tweets aren't legally binding

There's nothing in general about a tweet that makes it any more or less legally binding than any other public communication, and they certainly can be used in legally binding ways. But sure, a simple assertion to the public from the CEO of a privately held company about what a separate contract says is not legally binding - whether through tweet, blog, press release, news interview, or any other method.
by qazxcvbnm | 2026-02-28 05:27:49+00:00
M-n, M-p. M-r for searching on past commands. C-c c-n/C-p for next/previous prompt. C-c C-r to scroll to focus on output.

Having switched recently to Emacs, my current issue is how to get Emacs shell history saved properly for my other shell buffers, and getting completions from shell (not Emacs) to work, planning to try MisTTY soon.