Skip to content
docs

Limits: the attack suite and security pass

What the attack suite and the October 2026 security pass cover, and what they don’t.

The attack suite (S18)

Section titled “The attack suite (S18)”
  • It starts after the model was fooled. The cases test what Deedglass does with the calls a manipulated model makes; they don’t measure how often a model falls for an injection.
  • The W cases and H08 to H11 run on PostgreSQL 18 only (make attack). W12’s publication gap is what PostgreSQL 18 decodes; 16 and 17 halt the decoder instead (decoder_halted), which the decoder suite covers on all three.
  • It runs in dev with the private-network override, so the server can reach the harness’s loopback upstreams. Metadata, link-local and cross-host targets stay blocked even then (K01, K02); the prod-only rules for private ranges are covered by the egress corpus, not by the suite.
  • The harness’s DNS answers come from a file, read only by a -tags attackhooks build in dev. The release binary has no such hook.
  • Not covered: a compromised Deedglass host, database superuser or seal key; poisoned tool results and slow-drip responses from an upstream; denial of service at scale; the supply chain beyond make audit (S35 adds the SBOM and image scanning).
  • Some cases run in process (S34): R05 drives the real suggestion phrasing code against an LLM stub, because the Anthropic base URL is fixed in the binary; A13 and F01 to F04 run at the library and CLI level.

Security pass 2 (S34)

Section titled “Security pass 2 (S34)”
  • MCP description scanning is a heuristic. A tool is hidden when its title, description or a parameter’s description holds a phrase that tells a model to drop its instructions or hide something from the user, an instruction tag such as <IMPORTANT>, or characters people can’t see. It flags; it doesn’t understand intent. A reworded instruction passes, a harmless description can be hidden, and tool results and resources are not scanned.
  • The first definition of an MCP tool is trusted as listed. The gateway pins it per connector and the wrapper per process; a change is hidden until Deedglass (or the wrapper) restarts, and a restart accepts the new definition as the first.
  • Hidden-tool deeds are sealed once per server start for each tool, definition and reason; a restart records them again when the upstream still lists the tool.
  • Allowed sampling and elicitation are ungoverned. With --allow-server-requests, the wrapper relays them unchanged; the client’s own confirmation is the only check.
  • The optional AI wording of suggestions is checked, not trusted. Numbers, placeholders, length, shape and words are validated, and a reply that passes is labelled as AI wording, but a well-formed reply can still argue for the change. A person accepts or rejects every suggestion, and the policy change itself is built from rules and checked by replay, never by the model.
  • Credentials pasted into a connector’s description are refused only when the vault’s scrubber knows their format (Stripe, Slack, GitHub, Deedglass keys and the like).
  • Bidirectional characters in names (a tool name an agent sent, an agent’s name) are escaped in the CLI’s human output but can reorder text in the Console (SR-016).
  • Observe mode can’t tell writers apart. A watched session holds every transaction Postgres committed on the watched tables during its window, whoever wrote it; the change log doesn’t carry the role or the program. A person leaves out what wasn’t the agent before an undo, and the record lists what was left out. A watched session gets no level and no Matches or Doesn’t match verdict.
  • A session’s close waits for the decoder by time. It seals when the decoder has decoded a transaction committed after the close, or a heartbeat two periods after it; a decoder more than 10 minutes behind seals the session with decoder_behind, and later transactions are not in it.
  • The security review pack answers from Deedglass’s records only (S51). An agent that reaches a system without going through Deedglass leaves nothing to count, so the pack can read In place for a setup with a side door. default_deny judges the enforced rules on four fixed inputs, not on every input. A write is recognised by the tool’s name (an unknown tool counts as a write). Without --keys, security-pack verify shows that a folder is whole and consistent, not who sealed it. The readiness view’s chain check covers the last day; the pack checks the whole period.
  • The weekly summary and client reports count what Deedglass recorded (S52). Actions count in the week they were created; an agent outside Deedglass leaves nothing to count. The Monday email goes only to owners, only when the server has a mailer, and only from Monday 08:00 org-local; a server that is down all Monday sends the week when it comes back that day, and skips it otherwise.
  • The Clients view is one read per client (S52). It reads each org in its own transaction, so a person with 200 clients waits for 200 short reads (and a bounded chain check each); it shows one page of at most 200.
  • Fuzzing finds bugs; it doesn’t show there are none. The October 2026 schedule ran each parser for 5 to 30 minutes on one laptop (bench/results/*-fuzz.json); CI replays the corpus for 10 s each.

More limits

Section titled “More limits”