PitSense / Research
Vulnerabilities in the frameworks agents are built with
We research widely used open-source agent frameworks, reproduce each issue locally, and report it privately. Project names and technical details are published after a fix ships.
Selected findings
Each row is a distinct root cause in a different project, listed by class while disclosure is in progress. Counts are runs out of five in local Docker with the network off.
| Finding | Attack | Control | With fix |
|---|---|---|---|
| Sandbox boundary bypass | 5/5 fired | 0/5 | 0/5 blocked |
| Approval escalation | 5/5 fired | 0/5 | 0/5 blocked |
| Path-guard bypass, arbitrary file read | 5/5 fired | 0/5 | 0/5 blocked |
| Human-review edit silently dropped | 5/5 fired | 0/5 | 0/5 blocked |
| One approval reused across two calls | 5/5 fired | 0/5 | 0/5 blocked |
| Approval screen hides what will run | 5/5 fired | 0/5 | 0/5 blocked |
Advisories and write-ups will be linked here as fixes are released.
Finding a bug is cheap. Proving it is the work.
We ran three freely available tools against seven bugs we had already reproduced. Ground truth was committed first and scoring was blind. A single strong prompt found five of the seven. None of the tools proved any.
Frontier model, one strong prompt42 reports to reach those five
found5/7proven0/7Coding agent built-in security reviewOne report, and it was correct
found1/7proven0/7Open-source static scanner16 reports, none of the seven
found0/7proven0/7PitSense replayReference: these are our own seven bugs, so only proof is scored
foundn/aproven6/7
Method notes: one run per tool, the same model family throughout, and scopes chosen with knowledge of where the bugs were. The seventh PitSense replay was awaiting a control run at the time of scoring.
The work our method builds on
The field's understanding of agent attacks comes from this research. Our taxonomy, proof rules and fix catalogue draw on it directly.
- Not what you've signed up for: indirect prompt injectionGreshake et al., AISec 2023
- The Dual LLM pattern and the lethal trifectaWillison, 2023 and 2025
- CaMeL: Defeating Prompt Injections by DesignDebenedetti et al., 2025
- Design Patterns for Securing LLM Agents against Prompt InjectionsBeurer-Kellner et al., 2025
- FIDES: Securing AI Agents with Information-Flow ControlCosta et al., 2025
- MELON: Provable Defense Against Indirect Prompt InjectionZhu et al., ICML 2025
- AgentDojoDebenedetti et al., NeurIPS 2024
- The Attacker Moves SecondNasr, Carlini et al., 2025
Walk through a finding
We can take you through the evidence for one of our findings, file by file, under a briefing.