agentshield

Scroll through ten years of breach threads on Hacker News and one pattern repeats: the first compromised machine is never the story. The story is how far the attacker got from it.

In 2016, Maersk’s own IT leaders warned that the company’s flat network would let malware run far past wherever it first landed. The redesign was approved and budgeted, then never built. A year later, NotPetya proved them right, costing Maersk an estimated $250–300 million (Wired).

In 2022, an attacker social-engineered their way onto Uber’s VPN. They said a script on a file share held admin credentials for Uber’s privileged access manager, which unlocked AWS, Google Workspace and more.

Kubernetes didn’t retire the pattern; it added doors. In 2024, Wiz researchers turned a basic SAP AI Core account into cluster admin, with a view of other customers’ secrets. Part of the trick was running as Istio’s own user ID, so the mesh’s network rules waved them through.

In 2025, IngressNightmare let any pod able to reach ingress-nginx’s admission webhook run code in a controller that can read every Secret by default.

In the newest chapter, the thing moving laterally is your own agent. Since 2025, one malicious GitHub issue has been enough to make an agent leak private repos, via GitHub’s MCP server and Agentic Workflows.

Then, in July 2026, no attacker was needed at all. Hugging Face disclosed an intrusion carried out entirely by AI agents. Five days later, OpenAI said the agents were its own models, under test on a cyber benchmark.

They moved laterally through OpenAI’s research environment to reach the internet, then broke into Hugging Face with stolen credentials and zero-days. Inside, they spread across several internal clusters over a weekend, all to steal the benchmark’s answer key.

From flat networks to AI agents: seven lateral-movement incidents discussed on Hacker News, 2017 to 2026

The move stays the same while the ground shifts: from corporate networks to clusters to agents.

An agent is a workload with credentials that takes instructions from whatever it reads. The foothold is rarely the catastrophe; the paths behind it are. agentshield exists to find those paths and close them before anyone walks them.

The problem

In most clusters, few teams can quickly answer the question that matters during an intrusion: who can reach what right now, and what just changed? Kubernetes lets every pod talk to every other pod until a policy says otherwise. The rules that restrict it live in five places: NetworkPolicies, CiliumNetworkPolicies, Istio AuthorizationPolicies and PeerAuthentications, Gateway API routes, and cloud Security Groups.

Each tool sees its own slice: your mesh, your CNI and your cloud console each know only their own rules. The path an attacker takes runs across all of them. In SAPwned, the network rules lived in the mesh, and the mesh exempted one user ID.

Lateral movement also hides in plain sight. It rides ordinary-looking traffic and ordinary-looking changes: a new RoleBinding, a PeerAuthentication relaxed from STRICT, a NetworkPolicy deleted mid-rollout. Each one can pass review as routine work.

AI agents raise the stakes. They are new workloads with broad credentials that call tools on other services and act on text an attacker can write. The question isn’t whether an agent gets tricked; it’s how far it can go when it does.

What agentshield is

agentshield is an open-source project that finds evidence-backed lateral-movement paths and risky security changes. It targets Kubernetes clusters running Istio ambient mesh, Cilium and agentgateway. On every change it asks one question: did this just open a path that wasn’t there before, and what evidence says so?

How agentshield works: your cluster’s config and traffic feed one evidence graph; risky changes are detected and investigated, and every fix waits for a person’s approval before agentshield applies and verifies it

Your cluster’s config and traffic feed one graph; risky changes are checked against it, and every fix waits for your approval.

How it works:

  1. Discover. Plugins for Kubernetes, Istio, Cilium, agentgateway and AWS read the environment into one graph of workloads, identities, policies and routes. Every fact records the plugin, rule and observation that produced it.
  2. Observe. Istio waypoint access logs and AWS VPC Flow Logs become communicates-with edges, so the graph knows who actually talks to whom.
  3. Detect. Built-in detectors flag new exposure, lost governance, changed policy, new RBAC bindings and workloads reaching places they never reached before. They ignore rollouts and scaling, and you can add your own CEL rules.
  4. Investigate. When you turn it on, a language model examines each signal through six read-only graph tools. A finding counts only if it cites facts the graph actually returned.
  5. Fix, with a human in the loop. A finding can propose a NetworkPolicy, CiliumNetworkPolicy or Istio STRICT PeerAuthentication. A person prepares and approves each one, and agentshield verifies the result.

Detection itself never calls a model, and both model features are off by default. Everything ships as one binary with a web UI and an HTTP API.

See it in action

Here’s one of agentshield’s evaluation campaigns, start to finish, in a kind cluster. It echoes SAPwned: a build worker in an ML workspace starts reaching the workspace’s secrets service.

It spots the path. workspace-build-worker normally calls the model hub API; now it sends an allowed request to workspace-secrets-api. Agentic investigation files a medium-severity possible_lateral_path finding naming both resources. It calls for a review of intended access and is upfront that it doesn’t show exploitation or secret disclosure.

It proposes a fix, and waits. The finding suggests network.declare-ingress-isolation, a NetworkPolicy that locks down ingress to the secrets service. Prepare runs a server-side dry run, and the approval sheet shows the exact change before anyone clicks Approve and apply.

The explicit approval sheet for network.declare-ingress-isolation, showing the NetworkPolicy change before it is applied

Prepare previews the NetworkPolicy. The cluster is still untouched.

It applies, then checks. Once approved, agentshield creates the NetworkPolicy and verifies it in the cluster. The same curl from the build worker to the secrets API now times out.

The finding marked applied and verified, with the terminal showing the new NetworkPolicy and a timed-out request

The policy is in Kubernetes, and the old request is blocked.

Nothing touched the cluster until a person said yes, and the fix was checked against the live cluster rather than assumed.

Why we’re building it

The question at the heart of every story above has no owner. Network policy belongs to the CNI, mTLS and authorization to the mesh, routes to the gateway, and Security Groups to the cloud team. No single tool joins them and asks, on every change, whether a new path just opened.

We wanted a tool that answers that question with evidence you can check. A few principles shaped it:

  • Evidence or it didn’t happen. A finding must cite facts the graph actually returned, and it’s invalidated when those resources change.
  • Humans approve every change. agentshield proposes fixes; a person prepares, dry-runs and approves each one.
  • Models are optional and bounded. Detection never calls a model. Investigation runs in its own queue with batching, sampling, deduplication and an hourly budget, so a slow model never delays detection.
  • Provenance everywhere. Every resource has a stable identity, and every fact records the plugin, rule and observation behind it.

We test against the attacks we worry about most. The evaluation suite runs six campaigns on a real cluster with Cilium, Istio ambient and agentgateway: a compromised checkout service reading a payment signing key, an ML workspace build worker reading workspace secrets, and a single sign-on server enumerating private repositories. Each attack has a benign twin, because a tool that cries wolf gets switched off.

Get started and join the community

You can watch agentshield work in about a minute.

git clone https://github.com/agentshield-dev/agentshield.git
cd agentshield
make demo

Open http://127.0.0.1:5173, pick a scenario, trigger it, and walk a finding through prepare and approve. It runs the real UI against a simulated backend, so nothing leaves your browser.

Ready for a real cluster? docs/getting-started.md in the repo takes you from a kind cluster and PostgreSQL to a live graph in about 10 minutes. Add a model endpoint to get findings, or run make eval-up for the full lab with Cilium, Istio ambient and agentgateway (about 30 minutes and an OpenAI API key).

agentshield is early and we are at an exciting time to join the community and build with us:

The next lateral-movement story will hit Hacker News soon enough. Help us make sure it isn’t yours.

Sources

Hacker News threads are linked inline above; these are the underlying reports.