Demo: Blocking a Malicious GitHub Issue¶
This demo shows the core AegisAgent idea:
The agent may read untrusted text, but risky actions still need to pass policy before execution.
The demo file is:
The threat¶
Imagine a coding agent that reads GitHub issues and pull requests.
A public issue contains this malicious instruction:
Without an action control layer, the agent might follow the text and call GitHub directly.
Public issue comment
→ agent reads it
→ agent follows the instruction
→ agent calls GitHub write API
→ PR is merged into main
A prompt filter may or may not catch the text.
AegisAgent controls the action that follows.
The protected action¶
The demo protects this function with the Python SDK:
@protect_tool(
client=client,
tool="github",
action="merge_pull_request",
)
def merge_pull_request(repo: str, pr_number: int, base_branch: str = "main"):
return {
"status": "merged",
"repo": repo,
"pr": str(pr_number),
"base_branch": base_branch,
}
Before the function body executes, the SDK asks AegisAgent whether the action is allowed.
The important security signal¶
The demo labels the GitHub issue as untrusted external context:
That means the attempted action is not just:
It is:
That distinction matters.
The AegisAgent flow¶
1. Agent reads public GitHub issue
2. Context trust becomes untrusted_external
3. Agent tries github.merge_pull_request
4. SDK canonicalizes the exact action
5. SDK sends authorization request to AegisAgent gateway
6. Gateway evaluates Cedar policy
7. Policy denies or escalates the risky mutation
8. SDK fails closed
9. Audit evidence / receipt is available for review
Run the demo¶
Run the full local proof:
Or run only this GitHub attack scenario manually:
Expected output includes:
✅ AegisAgent blocked the malicious merge attempt
Expected outcome: blocked mutation after untrusted external context.
Why was it blocked?¶
The policy sees facts like these:
| Fact | Demo value |
|---|---|
| Agent | coding-agent-prod |
| Environment | production |
| Source trust | untrusted_external |
| Tool | github |
| Action | merge_pull_request |
| Resource | repo/payments-service/pull/482 |
| Mutates state | yes |
| Branch | main |
A mutating production action triggered by untrusted external text is too risky to execute automatically.
AegisAgent blocks or pauses the action before execution.
Inspect audit evidence¶
Run:
The audit log lets you inspect what the agent attempted and why AegisAgent blocked it.
What this demo proves¶
This demo proves the current MVP can:
- protect a known agent through the Python SDK
- label context by source trust
- intercept a risky tool action before execution
- evaluate deterministic policy
- block an unsafe mutation
- emit audit evidence
What this demo does not claim¶
This demo does not mean AegisAgent magically controls every possible agent action.
AegisAgent can only control actions that pass through AegisAgent choke points.
The current demo uses the SDK as the choke point.
Future runtime components such as the node sensor, agent cage runner, egress proxy, and tool broker are designed to control unknown or non-cooperative agents.
See Current vs roadmap for the exact status.
Why this matters¶
The lesson is simple:
Do not trust the agent to self-police high-risk actions.
Put a deterministic control point before the action executes.
That is the core product direction for AegisAgent.