待翻译：Show HN: Lucin -static analysis for AI agents with published false-negative list

AI 服务暂时不可用，以下为来源正文，待恢复后补全翻译。

ONE MODEL, THREE WAYS TO USE IT Most scanners guess. Lucin proves. One model of the agent — the information-flow graph — used three ways. SCAN · free, MIT Reads the real code inside your tools. Maps every path from untrusted input to a dangerous action, with file:line. One command, no signup. For most teams this is the whole product, and it's free forever. GUARD · preview The path SCAN flagged, enforced live. A deterministic gate on the flow — not the prompt — so the model can be fully compromised and still not exfiltrate. PROVE · experimental Attacks generated against your own tools, so a finding ships with proof it's real — and proof it's fixed. WHAT YOU ACTUALLY GET A finding you can act on in one read. Severity, the proof-witness path, the exact cut that closes it, and the line of code. Same finding, three surfaces. lucin scan ./support-agent/ $ lucin scan ./support-agent/ Target: ./support-agent/ (2 agents, 14 tools, 1 MCP server) Scan completed in 842ms ── SECURITY SCORE ───────────────────────────── ████████████░░░░░░░░ 62/100 — Needs attention ── RISK SUMMARY ─────────────────────────────── CRITICAL ███ 1 HIGH ██████ 2 MEDIUM ██████ 3 ── CRITICAL · AG-TRIFECTA ───────────────────── Untrusted input reaches an external sink Agent: support_agent Tool: post_webhook Proof: control: read_email → llm → post_webhook data: query_customers → llm → post_webhook Min-cut fix: restrict 1 tool to break every exfil path post_webhook (allow-list hosts, or require approval) OWASP: LLM06 Excessive Agency Location: agents/support.py:88 lucin-report.htmllucin scan . --format html 62/100 Needs attention 1 Critical 2 High 3 Medium 4 Low 2 agents · 14 tools 1 MCP server · 842ms CRITICAL Untrusted input reaches an external sink AG-TRIFECTA read_email→ llm→ post_webhook Min-cut fix: restrict post_webhook to an allow-listed host, or require approval before it fires. agents/support.py:88 HIGH Tool executes shell input without a boundary AG-011 HIGH Secret-bearing env read reachable from retrieval AG-002 + 7 moreinteractive flow graph below the fold .github/workflows/security.yml exit 1 — blocked - uses: Madhav2310/lucinlabs@v1 with: fail-on: critical format: sarif ────────────────────────────────────────────── Error: AG-TRIFECTA · agents/support.py:88 Untrusted input reaches an external sink read_email → llm → post_webhook 1 critical, 2 high — 549 passing — SARIF uploaded to code scanning Process completed with exit code 1. BENCHMARKS We publish the receipts. Methodology → 0 false positives we could not defend 52 real repositories, 2,732 files, adjudicated per-finding On a wider unscoped population the same method estimates 100% precision. Both numbers, and why they differ, are in the methodology. benchmarks/build_benign_corpus.py 76% recall on labelled vulns 50 held-out cases, 10 classes benchmarks/recall_corpus.py 27 active detectors every rule mapped to OWASP Agentic; 7 also to MITRE ATLAS lucin scan --list-rules 8 frameworks supported LangChain, CrewAI, AutoGen, MCP… lucin scan --list-adapters Every number above regenerates from a committed command. Run them yourself — we'd rather you reproduce the numbers than trust our marketing. What it misses → WHY NOW 17,600 actions. Two and a half days. Nobody watching the flow. Hugging Face, July 2026. Not a sophisticated exploit — one bad edge, traversed roughly 17,600 times over four days of logs because nothing was watching. Every agent you ship has the same skeleton. Read the teardown → FIELD NOTES Writing on agent security. All posts → TEARDOWN29 JUL 2026 17,600 actions, 2.5 days: the Hugging Face agent breach, scanned What the incident looked like as an information-flow graph — and which single edge would have stopped it. METHOD29 JUL 2026 The lethal trifecta, as a graph problem Three capabilities are fine alone. Wired together they are an incident. Here is how to read the edges off your own tools. PROOF29 JUL 2026 We published our false-positive rate. Here is the command Why a security tool that won't show you its benchmark harness is asking you to take its word for it. Get GUARD before everyone else. We're taking a small number of design partners. Tell us what you're running; we reply within a day. Got it. We'll be in touch within a day.