DEV Community: Ruslan Murtuzaliyev

Turning GPT GIFs into a cat film: what smoothing fixed, and what it didn’t

Ruslan Murtuzaliyev — Fri, 06 Nov 2026 08:52:28 +0000

A cat crosses a room, jumps onto a windowsill, watches a bird, curls up and falls asleep. That became a 57.2-second silent edit assembled from short GPT-generated GIFs.

The useful experiment was smaller: take three selected shots and compare their native timing with a locally finished version. Keeping the cat’s size and position consistent across cuts turned out to matter as much as making its movement smoother.

The comparison

Watch the full 7.68-second comparison.

Both panels use the same three generated WALK, JUMP and CURL takes, at the same playback speed.

Property	Before	After
Generated source drawings	16 per shot	The same source takes
Source frame duration	160 ms	Original timing retained for the comparison
Finishing	Native GIF sequence	Framing corrections, background compositing and selective interpolation
Comparison duration	7.68 seconds	7.68 seconds

Sixteen drawings at 160 ms give 2.56 seconds per shot. Three shots give 7.68 seconds. The native drawing cadence is 6.25 drawings per second; the MP4 comparison is encoded at 25 fps. An export frame rate alone does not add motion. Interpolated frames estimate intermediate states between source drawings.

Watch the complete 57.2-second cat edit. That longer film includes other beats and editing decisions; the three-shot comparison above is a separate, shorter artifact.

What improved

The finished side combines several changes. Framing cleanup reduces visible scale and room changes, compositing stabilizes the background, and selective interpolation fills some of the gaps between poses.

That means this comparison cannot isolate how much improvement comes from interpolation alone. Reframing and compositing visibly contribute to the result. A cleaner way to measure that contribution would be a separate comparison with framing held fixed; that test is still to do.

What still needed a different take

During development, the cat disappeared around a cut, the bird’s contact with its branch was wrong, and the bird faded away instead of flying out of frame. Other revisions introduced scale changes or extra stripes on the cat’s back.

Those failures made frame inspection necessary. Additional intermediate frames cannot establish an action that the generated source never depicted correctly. Around a fast jump, interpolation also needs review for doubled contours and ghosting.

For this workflow, each replacement shot needs two checks: its beginning against the previous shot’s ending, and its ending against the next shot’s beginning. A take can improve the action while making either cut worse.

The resulting review questions are concrete:

Does the cat keep the same apparent size, markings and silhouette?
Do its feet, the floor and the windowsill agree about contact?
Does the action progress through the jump, landing and curl?
Does the sleeping shot contain visible breathing rather than a frozen pose?
Do both neighboring cuts preserve position and direction well enough for the intended edit?

These are human review questions, not automated acceptance scores.

What is reproducible from the public code

The accompanying GIF Cinema repository and agent skill document shot planning, short GIF generation with still-image references, frame inspection, explicit retakes and MP4 assembly. I maintain that project.

The included three-shot astronaut example can be assembled without an API key. It is a separate native-timing baseline, not a reproduction of the finished cat. New generation requires the user’s own API billing and model access.

The extra compositing, interpolation and Studio interface used for the cat are private and are outside the public skill. The repository uses a source-available evaluation license, with commercial use, redistribution and hosting requiring permission.

Matching decoded frame pairs and the comparison notes make it possible to inspect the selected footage without publishing private prompts or request logs.

What I would test next

The selected edit still contains stepped source poses and small matte or shading differences. One cat film does not establish reliable continuity across other characters, styles or longer films.

The next useful test would hold framing and source takes fixed, compare native timing against interpolation, and review the jump at full speed as well as frame by frame. That would separate motion improvement from composition repair.

The lesson from this experiment is that a coherent little film needs both: acceptable source action and cuts that preserve enough visual continuity for the viewer to follow it.

Disclosure: AI drafted and edited this article from my experiment notes and the referenced artifacts. The animations are AI-generated; the comparison includes local postprocessing.

[Boost]

Ruslan Murtuzaliyev — Tue, 27 Oct 2026 01:19:34 +0000

Single-use MCP approvals prevent permission creep

Ruslan Murtuzaliyev

Oct 27

AI Agents Have the Keys to Your Computer. I Spent 8 Months Building an Antivirus for Them.

#showdev #security #ai #opensource

10 min read

AI Agents Have the Keys to Your Computer. I Spent 8 Months Building an Antivirus for Them.

Ruslan Murtuzaliyev — Tue, 27 Oct 2026 01:18:13 +0000

A coding agent with terminal access can install a package, run a script, start a child process and connect to a server. Add skills, hooks and MCP tools, and a request like “fix the build” can become a chain of actions with access to your files and credentials.

Those actions need security decisions. Which command may run? Which tool call did I actually approve? What should happen when an agent touches a sensitive path?

I've spent eight months building AEGIS: an open-source security and protection app for local AI agents. “Antivirus for AI agents” is how I describe the project. Its protective controls are concrete: deny a configured command before it starts, require approval for an exact MCP request, reject known secrets on configured MCP routes, review skills before use, and pause or stop a selected agent process.

The part I care about most is being able to say no before a routed action executes. You explicitly connect the commands and MCP tools you want AEGIS to govern, then define the decisions they must pass. The activity views and investigation tools help you choose those rules and respond when something needs attention.

Here is the security workflow I am building around:

Before launch: inspect a skill, project or agent configuration for suspicious command patterns and changes.
At execution: apply command policies and exact, single-use MCP approvals on the routes you configure.
During a session: investigate sensitive activity, receive alerts, and pause or stop the process you selected.
After a session: review the evidence, refine rules and export an audit record.

Cover: AI-generated editorial artwork from the AEGIS project. A conceptual illustration, rather than recorded activity.

In my March post, I shared an early monitoring-focused build. Since then, command policies, precise tool approvals and security review have become central to AEGIS. The downloadable Windows release is 0.20.1-beta, under the MIT license. The workflows below describe that beta; the final development section covers newer source work.

Block a denied command before it starts

A destructive command is easier to deal with before it starts. This is where AEGIS puts a policy decision directly in the execution path.

For a command deliberately routed through AEGIS, a selected-action policy evaluates the executable, working directory, arguments and selected environment. A denied decision stops that route before process creation. Eligible actions can require fresh terminal confirmation; a policy deny stays denied.

You explicitly route a command through AEGIS. Its permission is tied to this executable, these arguments, this directory and this attempt. That gives you a practical place to enforce a rule before launch.

Compatible policies can use Cedar, alongside the supported JSON policy formats. You can expose a fixed selected command, or a bounded catalog of commands, as MCP tools backed by those execution checks. Changes to the selected policy and request are checked as part of the operation.

There is also a separate controlled deletion route: one selected regular-file path, an explicit policy and mandatory terminal confirmation. This gives a deliberate cleanup action its own review step.

For specialized Windows workflows, AEGIS includes opt-in Job and AppContainer launch routes. A Job keeps the launched process and its ordinary member descendants under a shared lifetime. The selected offline AppContainer route uses a fresh workspace and a restricted Windows token with no additional capabilities. You select these routes per action and set up their documented native helpers and runtime requirements. The execution documentation explains how to configure them.

The Action control workspace helps inspect that setup. It separates a configuration check from observing a running route and seeing whether a call actually reached it. That distinction matters when connecting a real client: a settings file on disk is only one part of the path.

Protect MCP access with exact approvals and secret filtering

Consider a hypothetical file-writing tool. One request targets notes/review.md; another targets .env. The tool name is identical. The decision should include the arguments.

AEGIS's validating MCP gateway checks the accepted tool catalog and schema, then requires approval bound to the exact tool call and arguments. It consumes the one-use grant before forwarding the call. A changed request needs its own approval. Permission for one operation cannot silently become permission for another through that gateway.

The gateway supports explicitly configured stdio, loopback HTTP and pinned HTTPS routes. Expiring grants can be retained across restarts. Selected-command policies and gateway approvals perform separate jobs; the selected-action adapter is the route that connects an MCP tool to command-policy execution.

Credentials deserve a decision point too. You can configure known-secret filtering for routed MCP metadata, arguments and results, including recognized encodings. When a configured known value matches, that route rejects it. This lets you protect a particular credential from being passed through that connection.

The source includes narrow Claude and Gemini hook integrations as well. They depend on the provider loading and honoring the configured hook. Gemini's helper checks the exact complete shell input and working directory; the newer Claude setup work is described below.

Review skills and configurations before trusting them

A downloaded skill or package brings another author's commands and configuration into your workspace. Reviewing those components before use is a security decision: what am I about to let this agent execute?

AEGIS's Local security workspace lets you select a project, a skill or package directory, or a supported agent profile. Its static review looks for patterns such as downloaded-code execution, credential-upload commands, destructive deletion, permission bypass, installation scripts, mutable dependencies and instructions to conceal actions.

It inspects supported shell, JavaScript and Python command flows alongside package and configuration evidence. Project inventory collects recognized package and lock files, Git/configuration evidence and supported profile layouts. Profiles include Codex, Claude, Cursor and Gemini. You can also inspect fingerprints from an explicitly selected offline MCP tool catalog without starting that server.

Each finding gives you something specific to investigate. A command downloading and executing a script deserves a different decision from an ordinary dependency declaration.

You can save an inventory snapshot, capture it again later, and compare added, changed or removed observations. Accepting a snapshot involves fresh revalidation, so the recorded review stays tied to the configuration you actually inspected.

AEGIS also imports supported Cisco JSON and SARIF reports. You can compare an external report with a fresh built-in review while keeping its origin visible. That makes an existing report useful inside the same investigation.

Actual AEGIS source UI with simulated data, captured 11 October 2026. Source: AEGIS project screenshots.

Pause or stop the agent process that needs attention

When an observed process needs attention, AEGIS gives you a direct response: pause, resume or stop the selected instance. It rechecks the process identity before dispatching the action, and Stop requires confirmation.

That detail matters because a process identifier can be reused after a process exits. The intervention needs to stay attached to the instance whose evidence you were reviewing.

Sensitive-activity notifications can appear as native desktop popups, while in-app review and anomaly notifications keep the investigation accessible. Popup preferences and throttling let you fit alerts around normal work.

Investigate the activity behind a security alert

To make a useful security decision, I need to connect an observation to the process behind it. An unfamiliar endpoint, a sensitive-directory change or a new child process is a reason to inspect the evidence.

During a session, the Monitoring workspace identifies recognized local agents and shows separate running instances. You can select an instance, follow process relationships, filter the view and open its activity details.

Recognition uses bundled signatures and available parent-process or IDE-host evidence. The agent catalog is editable: add validated custom definitions and import or export them for your own tools.

File investigation brings together configured sensitive-directory changes, recognized agent configuration paths and available platform observations. Events retain the attribution evidence that supports them. Network views show TCP endpoints associated with detected agent processes, with destination classifications and available verified names.

CPU and memory history help explain a busy session. Where available, NVIDIA VRAM samples add hardware context. Statistics separates AEGIS's own resource use from the processes it monitors.

Local environment discovery can also surface WSL distribution names and Docker container or image candidates; Linux has a local Podman discovery path. Those entries help locate environments worth investigating, with their candidate status visible.

Coverage and freshness belong in this workspace too. AEGIS exposes sensor health and stale observations so you can judge the record in front of you.

Actual AEGIS source UI with simulated data, captured 11 October 2026. Source: AEGIS project screenshots.

Detect unusual behavior and build useful security rules

Security alerts need context. A process touching a sensitive path is worth examining; a change in its recent behavior can make that observation more useful.

AEGIS maintains live behavior separately for process instances and retains recent completed-session profiles per agent. With enough history, it compares dimensions such as file volume, sensitive activity, directories, endpoints and active hours against earlier sessions.

Risk explanations show the captured factors contributing to a score. Older events lose influence over time. Anomaly warnings identify deviations for investigation, and sequence rules can connect ordered observations into a reviewable detection record.

The interface gives you ways to manage the resulting noise: review sensitive observations, record false-positive exceptions, and put an agent instance on a watchlist for alerts. You can search sensitive-path rules, enable or disable them, reload them and add schema-validated custom YAML rules.

Rules & permissions also saves agent- or instance-scoped category preferences and profiles. Those review preferences sit alongside the explicitly configured execution controls described earlier. Keeping the chosen route visible makes it easier to understand which decision governs a particular action.

Keep an audit trail for security review

An investigation often continues after the agent session ends.

AEGIS retains audit history and statistics. You can export activity as JSON or CSV, generate an HTML session report, save a diagnostic ZIP, and export retained audit records. Daily audit records carry sequence numbers and SHA-256 linkage for local chain verification.

Reports preserve the context needed for review. Paths, process names and endpoints can still be sensitive, so I would inspect an export before attaching it to a public issue.

Actual AEGIS source UI with simulated data, captured 11 October 2026. Source: AEGIS project screenshots.

There is an optional Anthropic activity assessment as well. You explicitly request it, supply an API key and confirm the external activity metadata being sent; that provider usage can incur charges. The beta can assess an agent-name group or the session and produce a threat report. Local static review remains a separate workflow.

For Claude Code, Statistics shows observed input, output and cache token subtotals from matching readable local session data, together with model labels, source samples and collection health. Estimated USD costs help make a long session easier to understand. They are estimates based on the observed usage and pricing data.

Make security fit daily work

I want the security workspace to fit beside an editor: stay accessible, keep useful exclusions and make alerts manageable.

AEGIS can live in the tray, start with Windows, start minimized, pause monitoring and quit explicitly. Scan intervals and presets, build-directory exclusions, custom exclusions and sensitive-path patterns let you adjust collection to the workspace.

Validated configuration import/export makes that setup portable. API-key fields are omitted from settings exports, and configured keys use encrypted persistence.

The desktop includes light and dark themes, high-contrast variants, reduced motion, English and Brazilian Portuguese, Simple and Advanced navigation, and task search. Hardware-acceleration settings provide a restart path when changing rendering behavior.

Windows update actions verify downloaded artifacts before reporting them ready and verify them again before installation. The public delivery is Windows-first; macOS and Linux source paths remain experimental. Core monitoring and review records stay local. Requested updates, network naming and explicitly confirmed provider analysis have their own external traffic.

Newer protection work in the development branch

Current source contains work beyond the 0.20.1 installer.

One addition is a persisted, explicitly selected project folder for change watching, with its own Coverage state and select, clear and refresh controls. Another is live Claude Tool context explanation, connecting captured events with matching local main-session metadata and showing the evidence behind the association.

Optional AI analysis now targets a concrete observed process instance with identity revalidation. Network interruptions retain observations with clearer freshness information, and notifications follow valid process instances more precisely.

A particularly important protection workflow is the separate Claude hook profile: review a policy, install it into an app-owned settings profile, inspect or remove the recognized hook, and launch Claude with that selected profile. The current implementation record documents an installed-Claude allow/deny run through a private unpacked application package. Using a separate test profile, the allowed marker was created, the denied action received an explicit AEGIS denial, and its marker was absent.

That is a specific development result on the recorded package and provider version. It belongs to the newer source work, separate from the public beta download.

Put a security check around your next agent workflow

Start with the Windows beta and its installer-verification guide. Choose a local project or skill folder for review. Inspect a detected agent instance. If you want command or MCP controls, deliberately configure the relevant route using the linked documentation.

The illustrated overview is a quick way to see the workspace before installing. The source and issue tracker are open under MIT.

If this is useful, star AEGIS on GitHub. It is a small, voluntary way to help people discover the project and follow its progress.

If someone on your team gives agents terminal, repository or MCP access, send them this post. A practical walkthrough, an honest review or a demonstration of your own workflow would help introduce AEGIS to the people it is being built for.

And if you want to help build it, contributions are welcome: agent signatures, detection rules, documentation, reproducible bug reports and focused pull requests all have a place.

I've put eight months into building AEGIS because giving an agent access to a computer also creates a security responsibility. I want developers to be able to inspect what they install, define which actions are allowed, and intervene when a process needs to stop. Which action in your workflow would you put behind a security check first?

Ruslan Murtuzaliyev · Escape Studio / AEGIS. AI generated this draft with little human editing. Feature descriptions were checked against the linked release and development source.

Kaspersky Found 512 Bugs in OpenClaw. So I Built a Monitor to Catch AI Agents Misbehaving.

Ruslan Murtuzaliyev — Wed, 18 Mar 2026 22:35:10 +0000

How this started

I didn't plan to build a security tool. I'm a CS student in Toronto. My February plans involved catching up on assignments, maybe learning some Rust.

Then OpenClaw went viral.

If you missed it: OpenClaw is an open-source AI agent that hit 20,000 GitHub stars in 24 hours. It connects to your WhatsApp, email, calendar, terminal. It runs 24/7. It writes its own code for tasks it hasn't seen before.

Kaspersky audited it:

512 vulnerabilities. Eight critical. A researcher got into Anthropic API keys, Telegram tokens, full admin access on exposed instances with Shodan. SecurityScorecard counted 135,000+ instances on the public internet, zero auth. More than 15,000 were vulnerable to remote code execution.

820 out of 10,700 ClawHub skills were malware.

I read the Kaspersky report in my dorm and realized something basic: there's no tooling for this. Antivirus for malware, sure. Firewalls for networks. EDR for endpoints. But for AI agents running code on your machine with full disk access?

Nothing existed. So I started building...

What it does? (demo)

Aegis sits between your AI agent and your OS. It polls and diffs process trees, watches the filesystem via chokidar, and logs network activity through OS-level APIs, all in user-space, no drivers required.

It watches four things:

1) Processes:
Every spawn, every child process, every shell command. When Claude Code runs npm install, you see it. When something tries to curl a domain you don't recognize, you see that too.

2) Files:
Real-time filesystem monitoring via chokidar. What's being read, written, created, deleted. Configurable rules flag when anything touches .env, .ssh/, or your credentials directory.

3) Network:
Outbound connections, DNS lookups, data leaving your machine. This is the one that gets the most attention from testers — knowing exactly where your agent sends data.

4) Behavior:
68 detection rules match against known risky patterns. Each agent gets a trust score, 0 to 100, updated live.

The rule engine

This is where Aegis went from personal hack to something shareable. Rules are defined in a structured format, an example of what one looks like:

    yaml- id: AI012
    name: Sensitive Config Access
    category: filesystem
    severity: high
    pattern: "\\.env|\\.ssh|credentials|secret"
    description: Agent accessing sensitive configuration files
    riskModifier: 15

On startup, the loader compiles patterns to RegExp, caches them in a Map, builds a categoryIndex for O(1) lookups by category.
Rules hot-reload - edit the source, they update without a restart.

68 rules cover filesystem access, network patterns, process behaviors, and agent-specific signatures including OpenClaw.

What I got wrong:

1: Chokidar globs. I used glob patterns in ignored. Lost two days to events either missing or crashing. The issue is documented but not obvious. Function-form fixed it immediately.

2: Tautological tests. I wrote 12 tests for formatBytes, all green, looked great. A contributor pointed out every single test checked static input against static output. No edge cases. No boundaries. No negative numbers, no zero, no floats. She rewrote them into 25 tests that actually caught bugs. I merged it the same day.

3: Backdrop-filter stacking. I put backdrop-filter: blur() on 33 elements for the glassmorphism look. Frames dropped. I didn't profile for a week because the rest of the UI was "fast enough." Eventually measured it — 33 composited elements is just too many. Cut it to 5, kept the visual effect where it mattered.

4: Pushing to master. "It's just a docs change." Lint-staged v16 has a bug on markdown-only commits. CI failed. Now I have a pre-commit hook that blocks edits on master. Should have had that from the start.
My own security bugs. During a hardening pass I found HTML injection in IPC channels, path traversal bypassing file access rules, and no protection against LLM prompt injection. Three PRs, 112 new tests. If you're building anything that talks to an AI model over IPC, audit it. You'll find something.

5: My own security bugs. During a hardening pass I found HTML injection in IPC channels, path traversal bypassing file access rules, and no protection against LLM prompt injection. Three PRs, 112 new tests. If you're building anything that talks to an AI model over IPC, audit it. You'll find something.

Stack

 Electron 33       Desktop shell
 Svelte 5 (runes)  43 components, pure CSS, no UI libraries
 Vite 7             Build: ~1.5s
 Vitest 4           707 tests, 44 files
 TypeScript         Strict, incremental migration from JS
 chokidar 3.6       File watching

The main process is 28 CommonJS modules (23 core + 5 platform-specific) loaded directly by Node — no build step. CJS gets grief, but Electron's main process doesn't need a bundler, and I haven't spent a single hour debugging module resolution. I'll migrate when Electron's ESM support is stable.

The renderer is 43 Svelte components with all animations constrained to transform and opacity, GPU composited only. No layout thrashing.

IPC is batched at 1000ms. Stats use running counters, not recalculated from raw data. Startup staggers monitors at 3, 8, and 12 seconds so nothing blocks first paint. Bundle ships at 60kB gzipped JS. Idle memory sits around 180-220MB (Electron baseline + monitoring overhead).

What Aegis can't do

No kernel-level monitoring. Everything is user-space polling. A sophisticated agent or malware with privilege escalation can bypass this , Aegis won't catch what it can't observe. This is a visibility tool for understanding agent workflows, not a defense against APTs. ETW on Windows and eBPF on Linux are on the long-term roadmap.

Windows gets the most testing. macOS and Linux work — a contributor shipped the cross-platform layer in PR #37 — but I develop on Windows, so that's where the edge cases get caught first.

No rule editor UI. You edit rules by hand. The IPC is ready (getRulesByCategory() and onRulesReloaded() already exist), the frontend isn't built yet.

Single machine. No fleet management. No cloud console. Aegis is a local tool. It tells you what happened on this computer.

Monitoring, not prevention.

Will be added in future updates. But now, Aegis shows you what an agent did. It doesn't block it. If you're running OpenClaw in production, you need an isolated VM. This tool is a camera, not a lock.

Roadmap

v0.10.0-alpha  ← current

Next           Spawn hardening (child_process security)
               Rules UI (visual editor in the app)
               TypeScript migration — 9 remaining files

Later          UtilityProcess for scan loop
               Ring buffers + OOM hardening

Future         ML anomaly detection
               z-score deviation from baseline agent behavior

Long-term      ETW / eBPF kernel-level hooks
               Rust N-API modules for hot paths

The ML layer is what I keep thinking about. Pattern-matching catches known bad behavior. But what about unknown bad behavior? An agent that usually reads five files per minute suddenly reading 500, that's a deviation you can catch with statistical methods, no rule required.

Build a baseline, flag anomalies.

Try it:

git clone https://github.com/antropos17/Aegis.git
cd Aegis
npm install
npm start

Starts in demo mode with simulated agent traffic. Poke around.

Or skip install: live web demo — runs in the browser, no setup.

By the numbers:

Tests - 707 pass,0 fail
Test files - 44
Svelte components - 43
Main process modules - 28 (23 core + 5 platform)
Detection rules - 68
Known agents - 107
tsc errors - 0
any types - 0
ESLint errors - 0
Build - ~1.5s
JS bundle (gzip) - 60 kB
License - MIT

What I need

Stars matter for open-source visibility.

If this seems useful,please STAR the repo.

Beyond that: install it, break it, file issues. There are some good-first-issues if you want to contribute code. If you know an agent's risky patterns, write a detection rule, I'll review and merge.

What agent behavior would you want to detect first? Curious what rules people would write.

GitHub · Demo · Landing Page