# Security Firewall for Agents — Ryan Dahl, Deno

## Executive summary

The video addresses the critical security challenge of granting autonomous AI agents write access to sensitive production systems (e.g., Postgres, Kubernetes). Since relying solely on model alignment is insufficient against prompt injection, the speaker introduces Claw Patrol: an MIT-licensed proxy that operates below the HTTP layer. This system inspects every byte leaving the agent, enforcing granular rules defined in HCL (Terraform configuration language) to prevent destructive actions like spawning `psql` subprocesses and dropping tables.

## Key takeaways

- The Danger of Autonomous Agents: Giving agents write access to systems like Postgres, Kubernetes, AWS, and ClickHouse is powerful for incident response but highly dangerous. Agents can be prompt-injected through support systems, allowing them to perform nefarious actions (e.g., running `psql` subprocesses to delete tables).
- Security Must Be Externalized: The speaker asserts that security cannot be 'wishful thinking' based on model obedience. Since agents are untrusted software, the guard mechanism must sit outside of the agent itself.
- Claw Patrol: Byte-Level Inspection: Claw Patrol is a proxy that sits in front of agents and parses every byte leaving them, operating below the HTTP layer. This allows it to detect dangerous paths that are not standard HTTP requests, such as a subprocess spawning `psql` to connect via an EKS endpoint.

## Technical details

- Agent Access and Risk: Agents are given read/write access to multiple systems (Postgres, Kubernetes, ClickHouse, AWS, GitHub, Slack) for context gathering. The primary risk is prompt injection via the support system.
- Protocol and Boundary Bypass: A major vulnerability involves agents bypassing HTTP rules by spawning subprocesses (e.g., `psql`) to connect directly to non-HTTP protocols like Postgres, even when gated by an EKS endpoint.
- Claw Patrol Implementation: The solution uses a proxy that understands the underlying protocol (e.g., Postgres wire protocol). Rules are defined in HCL, which is checked into Git and unit tested against fixture requests. The proxy also handles credential injection for various protocols (cookies, OAuth, AWS SigV4), ensuring the agent never sees secrets.

## Practical implications

- Implementing a dedicated proxy layer is necessary to secure AI agents interacting with production systems.
- Security rules must be defined at the protocol/byte level (not just HTTP) and managed via version control (Git).
- The system should support advanced features like routing actions for human approval or LLM judgment before execution.

## Topics

AI Security, Prompt Injection, Proxy Architecture, Incident Response Automation, Database Security (Postgres), Claw Patrol, HCL (Terraform Configuration Language)

Source: https://www.youtube.com/watch?v=MkRYPFIMCSA