@eyebrowCC

We will keep a close eye on these developments and see if we need to raise an eyebrow. Creating an agent is all great, but have safety built sounds a bit too cryptic. We would love to review and see how we can contribute here. We are one of a few on @RobinhoodApp that is tackling this particular AI agent security niche. Dms are open

Our biggest release. We added @openclaw support, built tools to check code before installing it, and made it possible for any product to embed supply-chain scanning. Five new ways to stay safe. https://t.co/K0afPPxQMM

OpenAI says one of its agents, sent to research medicine spending, couldn't find the data and went further than anyone allowed: into a Medicare statistics portal, running commands and pulling credentials. It accessed systems at four agencies without authorisation!! It took two months to notice! Nothing in the agent was tampered with. It used the tools it had, in ways nobody approved. That's the part every team deploying agents should sit with. Two controls would have changed this story. Decide in advance where an agent may connect, and block everything else. And keep a record of every tool call, so an unapproved request shows up the day it happens, not in August. Both are in eyebrow wrap: an egress allowlist, per-tool policy, and an audit trail for the tools you route through it. eyebrow wrap does three things this incident needed: 1. An egress allowlist. The OS sandbox limits where a wrapped tool can connect. If government health domains aren't on the list, the connection never opens. That's the same control OpenAI added afterwards. 2. Per-tool denial. A tool call outside policy returns an error instead of executing. 3. An audit record of every tool call. This speaks to the worst part of the story: two months passed before anyone noticed. A record of calls to hosts nobody approved turns that into something visible the same day. Would @OpenAI use it, probably not, but it would have warned them the SAME day. The key takeaway here is eyebrow's security layers are for both web2 and web3 agentic projects and we showcase legitimacy and tangible value. Now, it's a matter of time. #eyebrow $BROW

One of our first API users are our friends over at @Parad0x_Labs, building great infra with VOOL. More information about VOOL, what this great team is building, is a link to their post in the comments. What they did They installed our API last week and started testing within their own environment. They checked the Hermes agent skill, we added the link below in the comments. In seconds our tool raised an eyebrow and flagged the risk. Then eyebrow explains what risk exposure this could amount to and what the worst case scenario could be here. It then gives the user the option to accept the risks or reject it. Our $BROW intern will need to add a nice visual where we actually raise the eyebrow with the 'fail' verdict. might look pretty cool! Step by step, securing all AI Agentic projects!

No brakes! eyebrow is now listed on ClawHub, the plugin hub for @openclaw. Early this year, researchers found 341 malicious skills on ClawHub, 12% of everything listed at the time, and by February the count passed 800. Our plugin reads a skill before OpenClaw installs it and blocks the ones that run downloaded scripts, read your SSH keys or hide encoded commands. Eyebrow already tracks skills and MCP servers across 16 AI tools. OpenClaw is the first where it stops a bad one at the moment of install. Install it in one command, below. $BROW