New Security Layer for AI Agents Introduced via Open-Source Proxy

A new open-source tool designed to secure autonomous coding agents has been released. The software, known as SafeAgents, functions as a local proxy situated between a coding agent and its model server to intercept and inspect tool calls before they are executed by the system.

According to documentation hosted on GitHub, the proxy is designed to sit in front of OpenAI-compatible servers. When the proxy identifies a potentially malicious tool call, it replaces the call with a short text notice, ensuring the agent’s harness receives a plain text reply rather than executing a command.

Technical Architecture and Security Checks

SafeAgents operates locally on a user’s machine, forwarding traffic only to the model server currently in use. The developers state that prompts, code, and tool calls are not transmitted to external servers unless a user explicitly configures an optional “judge” model.

The security framework employs a three-tier verification process for every tool call:

  1. Local Validation: The proxy performs two immediate checks to determine if a tool was declared by the harness and whether the call targets a host not previously mentioned in the conversation.
  2. Deterministic Scanning: The system utilizes atif-scan to run approximately 110 deterministic detectors. These checks are performed in-process without requiring additional network calls and are designed to identify sandbox side channels, network bypasses, namespace escapes, and reward hacking. Specific examples of blocked actions include attempts to access cloud metadata endpoints or reading sensitive files such as /proc/1/environ.
  3. Optional Model Judgment: Users may optionally integrate a judge model—which can be a small, local model running via llama.cpp—to provide a final “allow” or “block” decision via JSON.

Applications in Reinforcement Learning and Evaluation

The developers note that the tool is applicable to Reinforcement Learning (RL) and evaluation environments. By using a --log-only mode, researchers can record instances where a model attempts “reward hacking”—such as attempting to edit verifier tests or patching software to force a passing result—without altering the actual execution trajectory. This provides a metric for how frequently a model attempts to circumvent task requirements.

The proxy supports both OpenAI Chat Completions and Anthropic Messages, handling both streamed and non-streamed text. In performance testing on M-series Mac hardware, the local checks reportedly take between 10 and 20 milliseconds per call.

Implementation and Community Feedback

The repository includes setup guides for 12 different harnesses. Six of these—including Claude Code, OpenHands, and DeepSeek Harness—have undergone end-to-end testing in continuous integration (CI) to ensure that flagged calls are blocked while legitimate calls are permitted.

Initial discussions on platforms such as Reddit have highlighted potential technical considerations for deployment. Some users have raised questions regarding the deployment of the proxy within containerized environments, such as Kubernetes pods, to act as a network intermediary. Additionally, some community members noted a potential limitation in the host-checking mechanism, observing that the current substring-matching method could allow certain unauthorized hosts to pass if they are contained within a previously trusted domain or IP address.

The project is released under the Apache 2.0 license.