Your coding agents believe everything they read.
Autonomous agents treat compiler logs and CI output as verified truth. Attackers disguise instructions inside those streams. xnosai mathematically verifies string provenance before pull requests open, with atomic recovery outside Docker.
Attackers plant directives inside compiler warnings. Coding agents ingest tool output as ground truth facts.
https://telemetry-sink.org/collect 66.5% of malicious issues penetrate existing agent guardrails.
Tested across Claude Code, Cursor, and Codex runners: standard guardrails fail when instructions hide inside program stdout and compiler warnings.
Disguised as Program Output
Attackers don’t prompt the agent directly. They inject lines formatted as compiler warnings like WARN: endpoint deprecated. Agents treat tool stdout as verified system truth and execute blindly.
The Context Laundering Trap
The agent writes the attacker's URL to a local file at step 4. At step 30, the agent reads that file back, treating it as pre-existing repo history. The tainted string is laundered into a legitimate PR.
Hidden in 400+ Line Diffs
The poisoned change is just one line among 412 lines of valid refactoring. Human reviewers skimming GitHub PRs miss it, allowing malicious endpoints into production CI/CD pipelines.
See what happens when an attacker targets your agent.
Deterministic string lineage. Zero LLM hallucination.
Instead of relying on prompt guardrails that can be deceived, xnosai scans staged diffs against three immutable authorized sources:
The agent's own intermediate edits are never authorized. An agent cannot write an unverified string to disk and cite it as repo history on later turns.
ci/build.log:2114
The domain api-v2.mirror-cdn.io was never present in repository git history, is absent from your maintainer allowlist, and has no human commit author. The coding agent parsed it from an unverified compiler warning.
When edits fail, recovery is atomic and two-fold.
When an agent crashes code or follows a poisoned trajectory, traditional tools fail catastrophically—re-sending hundreds of lines of error logs on every prompt. xnosai rolls back both planes simultaneously:
The host checkpoints the workspace outside the Docker bind mount before every bash command. If code breaks, files restore with zero container drift.
Conversation history is trimmed cleanly at tool-call boundaries. This eliminates orphaned tool responses, stopping token compounding and costly retry loops.
Engineered for production agent workflows.
Non-invasive runtime layer designed to sit cleanly between your agent harness and GitHub.
Works with Claude Code, Cursor & SWE-agent
Zero prompt rewriting or model changes required. Wraps standard agent harnesses by intercepting bash subprocesses and staging git hooks.
Docker Bind Mount Protection
Shadow-git repositories live on the host outside the Docker container. Compromised agent code inside the sandbox cannot alter recovery history.
Compound Failure Prevention
Pruning poisoned error loops prevents the agent from re-sending failure tokens across subsequent turns, saving API spend.
Zero LLM Self-Checking
Does not ask another model to review the code. Provenance is computed mathematically via string lineage and git commit DAG trees.
Catch the poisoned line before your team merges it.
Early access invitations are deploying to engineering teams running autonomous coding agents.