# malicious approval — X 热门讨论 (2026-09-10 22:33 UTC)
## @0xZenad (Zenad) · 09-10 17:26 · ♥21 ↻0 💬14 AN AGENT WITH SHELL + BROWSER + API KEYS ISN'T A CHATBOT ANYMORE
10 repos I'd put between it and production:
1) OpenShell
Run Claude Code, Codex, OpenCode and other agents inside a sandbox instead of directly on your machine
You can restrict files, credentials and outbound network access with policies, so the agent only gets what the task actually needs
https://t.co/HEgIRudGRy
2) agent-sandbox
Kubernetes primitives built specifically for isolated, stateful agent workloads
Give each agent its own environment instead of letting multiple autonomous jobs share the same filesystem and process space
https://t.co/xIbpS5pkgZ
3) E2B
Spin up disposable cloud sandboxes for AI-generated code
The agent can install packages, run commands and create files without executing that code on your laptop or main server
https://t.co/D3Mqd4a191
4) agent-guard
Put a permission layer in front of the tools your agent can call
A model can request a shell command, database write or API action, but policy decides whether it actually runs
You can also require human approval for the stuff you really don't want automated
https://t.co/ebfyz5LCy0
5) agent-scan
Scan the MCP servers and skills installed around Claude Code, Cursor, Gemini CLI and other agents
It looks for things like prompt injection, suspicious downloads, exposed secrets and destructive capabilities before you trust the component
https://t.co/ikk4vr8WQq
6) Guardrails
Put checks around what enters and leaves the agent.
Useful for catching jailbreaks, unsafe content and other inputs you don't want flowing straight into an autonomous workflow
https://t.co/CI7zyebHsP
7) browser-agent
A browser agent where risky actions aren't treated like normal clicks
Sending, deleting, paying and other high-impact actions can require confirmation, while every tool call goes into an audit log
https://t.co/89d1AcG4SE
8) AgentDojo
Test whether your agent gets hijacked by instructions hidden inside emails, websites and tool outputs
It gives you realistic tasks where the agent still has to finish the job while ignoring malicious instructions along the way
https://t.co/VkT6vZccfT
9) PyRIT
Red-team an agent before somebody else does
Automate adversarial conversations and probe the system for failure modes instead of finding them after you ship
https://t.co/WwSF26T18F
10) garak
Basically a vulnerability scanner for LLM systems
Probe for prompt injection, data leakage, jailbreaks, hallucinations and other failure modes across different models and endpoints
https://t.co/3XciPDQpFC
if an agent can use shell, browser, MCPs and real credential
I'd want 4 things before giving it more autonomy:
isolation least privilege human approval red-team tests
more tools can wait > 引用 @0xZenad: 30 Open-Source Repos for AI Builders https://x.com/0xZenad/status/2098100741390901295