I've been building this mostly solo for a while and I'm at the point where it needs more people than just me.

My honest take: getting an agent to work isn't the hard part anymore. The hard part starts once you have more than a handful of them. Which agents call which models? Which MCP tools can they reach? What are they hitting directly that never goes through anything you control? If you can't draw that picture, you can't really secure or govern any of it, and right now most tooling just doesn't draw it.

So I built Control Tower. It's a self-hosted gateway for LLM and MCP traffic (OpenAI-compatible, usually two env vars to point an agent at it), and the main thing it does is build a live map of your agent ecosystem from the actual traffic:

- every API key is an agent, every model / MCP server / outside system is a station, and the lines are who's talking to who right now

- traffic that skips the gateway can still be reported (one call to /v1/observe, or point any OpenTelemetry exporter at /v1/traces) and it shows up as a dashed line. Solid means Control Tower is actually in the path and enforcing it, dashed means we only saw it. I was strict about that on purpose, because a security map that overstates what it controls is worse than no map

- you can export the whole thing as a Markdown or CSV data-flow inventory, which in my experience is the thing reviewers actually ask for

- once you can see a path you can put a gate on it: allow, deny, require a human to approve, limits, or inspect

Where I'd really like help:

- the biggest open gap: an egress proxy sidecar for traffic that bypasses the gateway entirely. Right now that traffic is seen but not stopped. It's on the roadmap and it's a meaty problem if networking is your thing

- provider adapters (there are a lot already, there's always another one)

- new detectors for the inspect gates (PII, secrets and prompt injection today)

- if you run OpenTelemetry in a messy real-world stack, I want to know where the mapping breaks

- docs, bug reports, all the usual stuff

It's TypeScript (strict), Node 24 and pnpm. Demo mode spins up a fake agent fleet with stand-in providers, so you can hack on it without any API keys:

pnpm install

CT_DEMO=1 pnpm dev

CONTRIBUTING.md has the rest. For anything bigger than a small fix, open an issue first so we can agree on the approach before you sink time into it.

License is Apache-2.0. To be upfront: enterprise features live in separate `ee` directories, and everything outside those is Apache.

Repo: https://github.com/joshmaster2165/controltower

Site: https://agentcontroltower.app

Happy to answer anything, including "why not just use X". And if you think the map is wrong about something, I'd honestly like to hear that most.

My boss has challenged me to cut down the tier 1 queue without adding headcount.

We manage Windows devices through Intune and the RMM side is pretty standard.

One idea he mentioned was an autonomous IT platform that handles the routine stuff on its own (password resets, reboots, basic troubleshooting), then notifies the user with something like "We noticed X issue with your laptop and automatically resolved it."

I know there are tools like Ansible and other automation platforms, but not every task has a playbook ready to go, especially when troubleshooting something unexpected.

Atera came up because the IT Autopilot stuff is built into the RMM/helpdesk, NinjaOne came up too. Can any of these do this without giving the AI agent the keys to the kingdom?

I'm curious how you guys handle this in your environments. Is most of your routine work already automated, or do you still spend a fair amount of time fixing things manually?

Would love to hear what's actually working!

In May 2017, WannaCry tore through hospitals, factories and railways using a Windows flaw Microsoft had already patched. Then a 22-year-old researcher slowed it down by registering a $10.69 domain name.

I run a small, faceless channel called Kill Switch Stories that retells real cyberattacks as true stories, then explains the simple habits that would have stopped them. Episode 1 covers WannaCry (about 8.5 minutes, every claim sourced in the description): https://youtu.be/kt2uvKR8tXE

Tomorrow's episode: Colonial Pipeline, where one old VPN password with no second factor shut down America's biggest fuel pipeline.

Curious what you all think. Is "the patch already existed" still the biggest lesson from WannaCry, or is it something else?

hello community

been building this thing for a while now and finally made it public. basically an AI hackbot that automates the whole vuln-finding + web CTF process. free and open source, no catch.

some results so far — it solved 60+ CTF tasks on its own, mostly web, and a few hard ones too (still kinda surprised at that ngl). also found 3 confirmed vulns on targets i had permission to test. repo’s got a bunch of other stuff but web pentesting + CTFs is where it actually shines.

i know there’s already a ton of agents out there so “yet another hackbot” i get it lol. but the approach here is a bit different — instead of the usual agent loop, RedBox models the attack as a relational graph. it tracks a “hypothesis” from the very first signal all the way to validation, using belief graphs + conditional structures + validation formulas to decide what’s actually worth chasing and when a finding is legit. the whole point was to let even a small/free model converge to a reliable result while cutting false positives and hallucinations. it also keeps a memory of past runs so it gets stronger every time you run it.

anyway i’d genuinely love for people to go check it out, break it, roast it, whatever. and im super down to talk architecture or take contributors if anyone’s interested.

repo: https://github.com/H3DD4/RedBox

Hello everyone,

I am a researcher looking for an arXiv endorsement in the Cryptography and Security (cs.CR) category to submit my latest paper.

• Paper Title: A Comparative Evaluation of LLM-Based Cybersecurity Analysis:

Mistral-7B, Llama3.2, andLily-Cybersecurity on Live IDS Data

and Benchmark Datasets

• Field: Cybersecurity / cs.CR

To protect the confidentiality and intellectual property of the research, the abstract, GitHub link or the full draft are available.

If you are an eligible endorser in the cs.CR category and willing to help, please comment below or send me a DM. I would be glad to share the abstract and the full paper draft with you privately for review.

Thank you so much for your time and support!

Hello!
Job position available: Saturdays full day permanent position 16 hour shift from 6:30am-10:30pm at 146 Liberty Street South Bowmanville ON
Phone number: 905-623-7790
Other days also needed. Experience in gas station preferred.

Ran into this last week while updating a couple recipe posts. I fed a generator a prompt for a new herb mix and the output looked fine until I tried uploading the draft. The site blocked it with a modsecurity rule on one line. Switched models and the same thing happened with different text. The phrases don't look like attacks to me, but they match whatever word order the rules are set to catch. Manual cleanup didn't help since the next run just created new strings that tripped the same rules. Wondering how often this happens with normal writing and if anyone found a fast way to strip whatever the WAF is actually looking for.

Their main worry is agents being talked into "authorized-looking" actions. The framing that stood out: the main risk isn't the model making a mistake; it's an attacker instructing the agent to do something that looks authorized. Their approach is defense in depth: monitoring, auditing, guardrails, and a kill switch to shut down a misbehaving model.

Also in the piece: TII's CEO says an agent you can't monitor in real time "is malware that got access to your machine," and that non-human agents need clear identities. Kaspersky describes "living off local agents," where attackers use an agent already on the machine to find valuable data.

Source: www.khaleejtimes.com/business/tech/ai-agents-tricked-accessing-sensitive-government-data-cybersecurity

For those running agents in production: do your agents have their own identities and least-privilege scopes, or do they inherit a user's or service account's permissions? And who owns the kill switch?

I mean I understand that they were outdated and that someone figured out a way to exploit them, but shouldn't they be exposed on a local network. I guess that the attacker was suitably positioned.

Does any one has more info about this story ?

Hello everyone,

I am a researcher looking for an arXiv endorsement in the Cryptography and Security (cs.CR) category to submit my latest paper.

• Paper Title: A Comparative Evaluation of LLM-Based Cybersecurity Analysis:

Mistral-7B, Llama3.2, andLily-Cybersecurity on Live IDS Data

and Benchmark Datasets

• Field: Cybersecurity / cs.CR

To protect the confidentiality and intellectual property of the research, the abstract, GitHub link or the full draft are available.

If you are an eligible endorser in the cs.CR category and willing to help, please comment below or send me a DM. I would be glad to share the abstract and the full paper draft with you privately for review.

Thank you so much for your time and support!

I'm looking into vendors for a third-party security assessment and Sygnia and Kroll are two options I'm considering. Does anyone have any experience working with either of them? How was the engagement and did they meet your expectations

We are using our IR playbooks and shadowing to bring new responders up to speed. I'm looking for something that gives them practice making calls before they join the on call rota. Reading the escalation path is easy. Knowing when to use it with half the facts is harder.

The main focus is deciding when to escalate and giving the incident lead a useful update. Reflex Security and Immersive Labs are on the list for their crisis simulations. Reflex scenarios adapt to team decisions which is the part Id want to test.

Senior responders would still review the reasoning afterward. The catch is prep time. If every short session needs someone to write a new scenario and spend an afternoon taking notes it wont happen often.

Given the case a support agent reads a ticket with instructions buried in it then tries to send a customer record to the wrong destination, Its final reply can look completely harmless. The tool call is the bit that matters.

Alice positions wonderfence as runtime guardrails.For an agent like this the first thing I'd want to pin down is where the check happens, a blocked response wouldn't undo a record already sent.

The tool itself would still need to check whether that user is allowed to access the record and send it to that destination. i'd want a test with a dodgy ticket (a normal ticket asking for the same permitted action) and a trace showing whether either tool actually ran.

For people adding guardrails around tool-using agents what evidence do you ask for to check that the risky action gets stopped without breaking ordinary requests?

We've been evaluating Nucleus as a normalization and prioritization layer on top of our existing scanning stack, not a replacement for it, the scanners stay, we just wanted one place that actually makes sense of what they're all flagging. So far it's pulled in data from most of our stack (SAST, DAST, SCA, container scanning, CSPM, ASM, CMDB, ITSM) without us needing to build a custom integration for each source, which was more of a lift than expected going into this. The part we're still digging into is how the risk scoring adapts once you're past the initial setup. It's supposed to weight asset context and business impact together with exploit and malware evidence rather than just leaning on CVSS, which lines up with how we actually want to prioritize, but we want to see it hold up across a few more use cases before we call it settled. For anyone running Nucleus in a similar multi scanner setup, what did you end up tuning in the scoring model once you got past the default config?