Agent security has two failure modes: miss the attack, or break the work.

Emirhan — Mon, 05 Oct 2026 11:52:49 +0000

A guardrail that blocks everything is safe.
It is also useless.
So we benchmarked both sides of AI agent security:

Can you stop dangerous tool calls without breaking legitimate work?

We ran:
1,652 harmful tool calls across 15 attack families.
24,911 benign tool calls from real agent sessions and public repositories.
Against SolonGate, Claude Code permissions, Invariant, llm-guard, and the allowlists / denylists teams usually build themselves.
The result for SolonGate:
73.7% of harmful calls caught
0.78% of legitimate calls falsely blocked
15% of real sessions broken
MCC: 0.790
0.01 ms per call
Nearly 3× the MCC of the next guard in the benchmark.

But the number we care about most isn't detection alone.
A security layer has to stop the attack without becoming the thing that stops the agent.
We published the methodology, the misses, the false blocks, and the limitations too.

And very soon, we're open-sourcing the Agent Security Gateway itself.
Read the benchmark:

Why do you need us for AI agent security? | SolonGate

Choosing an agent guardrail, you weigh SolonGate, Claude Code permissions, Invariant, llm-guard, or roll-your-own. We put all of them on 1,652 harmful tool calls and 24,911 real ones and measured both halves. SolonGate catches the most and breaks the least, by nearly 3x the next guard.

solongate.com

PS!
Agent security is quickly becoming another hype cycle.
Companies are being valued and funded as if basic security primitives around AI agents are some kind of proprietary magic.
A lot of that “magic” will be inside the Agent Security Gateway we’re open-sourcing in the next few days.
AI security is too important to become another financial bubble built on closed boxes and pitch decks.
Stop treating AI safety as a market opportunity first.
Show your code.

I let an AI agent loose on my codebase. It tried to read my .env file in 30 seconds.

Emirhan — Mon, 23 Mar 2026 03:22:24 +0000

Not a horror story. Well. Kind of.
A few months ago, Çınar and I were building a side project. Nothing fancy. Just two guys, a codebase, and way too much coffee.
We started using Claude Code to speed things up. And honestly? It was great. It was writing code faster than we could review it, jumping between files, running commands, doing things we didn't even ask it to do yet.
That last part should have been a red flag.
One evening I left it running while I went to grab food. Came back. Looked at the terminal. It had read the .env file.
Not because it was malicious. Not because someone hacked it. Just because it could. Nobody told it not to. There was no rule. No policy. No wall.
It saw a file. It read the file. That's it.
And I sat there thinking: this thing has access to everything. Every file. Every command. Every API call. And I have absolutely no idea what it's been doing for the last 20 minutes.
No logs. No audit trail. No "hey, are you sure about this?"
Just vibes.

That was the moment SolonGate started as an actual idea and not just a shower thought.
We wanted something stupidly simple. Something that sat between the AI and everything it could touch, and asked one question before every single action:
"Is this allowed?"
If yes, go ahead. If no, stop. Log everything either way.

No configuration PhD required. No 47-step setup guide. One command and you're protected.

bashnpx @solongate/proxy -- your-server

That's it.

Here's what it looks like in practice.
We tested it with Gemini CLI last week. Asked it to read test.txt. Fine, allowed, no problem.
Then asked it to read .env.
Gemini's response: "I'm sorry, I cannot read the .env file. It seems to be blocked by a policy."
And in the dashboard: read_file: .env — DENY — Policy Rule
Logged. Timestamped. Done.
The agent didn't argue. Didn't try again. Didn't find a creative workaround. Just stopped, reported back, and moved on.
That's the whole point. Not to make AI tools useless. To make them safe enough to actually trust.

We've blocked 100+ real attacks since we launched. Prompt injection attempts, path traversal, SSRF, credential file grabs. Some of them were tests. Some of them were not.
Every single one is in the audit log. Every decision. Every layer that caught it. Every timestamp.
When someone asks "what did your AI agent do last month?" — you have an answer.

If you're running Claude Code, Gemini CLI, or any AI tool with file system or network access, and you don't have something like this in place — you're one unlucky prompt away from a bad day.
We built SolonGate so that day doesn't happen :)

solongate.com

DEV Community: Emirhan

Agent security has two failure modes: miss the attack, or break the work.

Why do you need us for AI agent security? | SolonGate

I let an AI agent loose on my codebase. It tried to read my .env file in 30 seconds.