Teams now ask an agent to "look through the staging app and file tickets". That sentence hides a permission model. If the process can read the repo, call the browser, and hit internal APIs with the engineer's SSO cookie, you did not hire a reviewer. You opened a shell.
The problem
“Let the agent review the staging site and file tickets.” If the process reads the repository, drives a browser and calls internal APIs with an engineer's SSO cookie — you didn't hire a reviewer. You opened a shell.
What we did
Wrote AGI Core — a Rust runtime for agents, not a wrapper around someone's framework. Every tool call goes through our own capability sandbox: files, APIs and services exist only inside the grants issued. In Forge IDE the grants are JSON skills in UIDE.
What came out
A procedure: write down the job → issue grants for this repository, this staging site, this profile → watch the step stream. No capability, no call. Not an “autonomous pentest” but a kernel that refuses the extra syscall.
This piece is about isolation for agents you own, on work you already authorized. Not about giving a model a target on the public internet.
The failure is the missing grant
A helpful default — "the agent can use whatever the human can" — copies the human's blast radius and removes the human's judgment. The model will retry. It will follow a link in its own scratchpad. It will paste a secret into a prompt because the stack trace sat next to it.
A security review makes this worse, not better: the agent is supposed to touch auth flows, admin routes, exported dumps. Without a capability boundary, "review staging" and "read ~/.ssh" are the same syscall class.
What we actually built
AGI Core is our Rust runtime for agents — not a wrapper around someone else's framework. Tool calls go through a capability sandbox we wrote: each call is isolated; APIs, filesystem and external services exist only inside the grants you attached. The planner splits work, replans on failure, and streams every step on our WebSocket protocol so a human can see the grant get used.
Memory is a graph that survives the session, with our indexing — so the agent can remember this app's notes without sucking in the whole home directory.
In Forge IDE the reusable behaviours live as JSON skills in UIDE. The skill file is the grant list in human form: what page, what screenshot, what it must not open. The editor drives the browser; the core runs the agent. Different processes, same rule — no capability, no call.
A review that does not become the incident
- Write the job (assessment or a narrow authorized pass — the distinction).
- Attach grants: this repo, this staging host, this browser profile. Nothing else.
- Watch the stream. If the agent asks for a tool you did not grant, the answer is no.
That is the whole product claim. Not "autonomous pentest". A kernel that refuses the extra syscall.
What we refuse to claim
AGI Core is not a button that "does a pentest by itself". It will not invent a scope or bless a host you did not grant. The engagement is still a human contract — the kernel only refuses the extra syscall. If the stream shows a tool you do not recognise, you stop the run — the same way you stop a script that started writing outside the repo.
An agent without a permission boundary is the next incident, not an assistant. We build and sell agents on our own runtime precisely because we know where their permission model breaks — and we offer to review the isolation of the agents you already run.What you can order from us
Zero Day Labs takes authorized security work — we use the same products described in this series, not a rented scanner PDF.
You can write to [email protected] or the contact form and ask for:
- a security assessment (map of assets, controls, residual risk);
- an authorized pentest on a written scope;
- a web application review (from the editor: DOM, network, evidence);
- a review of agent and tool isolation (what the agent is allowed to call);
- help making test fixtures honest (locale, timezone, exit address) so the report describes your system, not the tester's laptop.
Say which job you want, the scope, and what "done" looks like. We reply with a concrete proposal — same rule as the rest of the site.
Products in this article
Review the isolation of your agents
How grants are issued, what the process can reach, what ends up in the prompt — an audit of the agent loop with a written scope.
Security assessment vs pentest: three different jobsAssessment, pentest and scan are three jobs. Zero Day Labs takes authorized work on a written scope — and runs it on our own tools, not a rented scanner PDF.
Web security review from the editorMost authorized web reviews die in the gap between the IDE and a pile of browser windows. Forge IDE keeps the code, the live page and the notes in one process.
VPN Chrome extension: what it protects and what it doesn'tA Chrome VPN extension is a proxy for browser traffic only. What it really protects, where it leaks, and when you need a full VPN app instead.