Sarah Sanders presents PostHog's Wizard, an agentic command-line toolAn AI coding agent is a tool-using AI system that can inspect, modify, and validate software within a repository. that reads a codebase, installs the appropriate SDK, instruments events, and builds dashboards. Those capabilities also give the agent a malware-like risk profile because it can consume project context and run commandsAgent tool use lets an agent call bounded external capabilities so it can retrieve information or change state beyond generating a response. on a developer's machine.
The security review found that prompts alone were not controls and that individually reasonable features could combine into exploitable paths. The system therefore denies Bash by defaultAn agent permission boundary defines and enforces which resources and actions an automated agent is allowed to use., restricts packages and commands, blocks environment-file access, routes secrets through a vault, and scans both content entering the agent and output leaving it.
A deterministic YARA-based scanner called Warlock separates detection from enforcement and caught risky behavior including subagents trying to bypass guardrailsA guardrail is a technical or procedural control that limits unsafe, disallowed, deceptive, or otherwise unwanted AI behavior., attempts to obtain secrets, and personally identifiable information being written into analytics events. An LLM triage layer may reduce false-positive noise only after deterministic rules have blocked dangerous input, and any triage failure closes the workflow.
The practical lesson is defense in depthDefense in depth protects an AI system with several independent security layers so one failure does not expose the whole workflow.: scan the context supply chain when skills are built and again when they are used, test rules against positive and negative examples, set severity by real-world impact, and keep probabilistic judgment away from the enforcement path.
Watch on YouTube
