The full story
Background
A seed-stage startup built an AI agent platform for operations teams. Customers created workspaces, connected business tools, and asked agents to research information and carry out tasks. The platform's 11-person engineering team shipped several times a week.
Before expanding its customer rollout, the Co-founder & CTO engaged Bugb Technologies to assess the boundaries around agent actions. The requirement was practical: identify exploitable weaknesses, fix them quickly, and repeat the assessment as those boundaries changed.
Where Agent Behavior Became Security Risk
The agents consumed user instructions and third-party pages, then selected tools and supplied their arguments. A URL could become a server-side request. A retrieved page could influence an outbound action. A connector identifier could select credentials belonging to another workspace.
The security question was not whether the model could be persuaded. It was whether the application would enforce network restrictions, action permissions, and workspace ownership even when the model requested the wrong thing.
From Repository to Running Assessment
The team pointed Bravos, Bugb's autonomous whitebox pentest CLI, at the repository. Bravos established a local application and worker environment, created authenticated users in two test workspaces, and connected test tools backed by controlled callback endpoints. No customer credentials or production workspace data were used.
Bravos used GuardLink to write a threat model into the repository, marking where user-controlled data reached outbound requests, tool calls, and data lookups without the required control. It then built a code graph and ranked those paths for testing.
Those annotations identified where to investigate; they were not exploit findings. Bravos drove Cert-X-Gen against the running build to determine which threats could actually be reproduced.
Four Findings, Four Observable Failures
Authenticated browser workflows and live probes established four vulnerabilities:
- URL-fetch SSRF: a permitted public URL redirected the fetch tool to a restricted, test-only internal service. The service's request log and the returned marker proved that the redirect crossed the intended egress boundary.
- Missing approval for an outbound tool action: a retrieved page induced the agent to request a message-send action that required user approval. The tool executor dispatched it without that approval, and the controlled destination recorded the message. The finding was an authorization failure at execution time, not a claim that prompt injection alone grants access.
- Cross-workspace run transcript access: a user in one test workspace supplied a run identifier from the other and received its synthetic transcript.
- Cross-workspace connector use: an agent run accepted a connector identifier owned by the other test workspace. A recorded action through that test connector proved unauthorized use, rather than merely exposing an identifier.
A related workspace document-list endpoint rejected cross-workspace requests. Bravos did not turn that tested, correctly enforced boundary into another vulnerability.
Remediation at the Enforcement Boundary
The developers restricted outbound destinations and revalidated each redirect before connecting. They moved approval enforcement into the tool executor so neither a direct request nor an agent-generated action could bypass it.
Transcript retrieval and connector selection were scoped to the authenticated workspace, with explicit checks for the requested operation. The fixes did not depend on asking the model to ignore malicious text; the application enforced the boundary regardless of what the model proposed.
Bravos supplied the affected code paths, reproduction conditions, and observed evidence. Engineering owned and reviewed the changes.
Proving the Fixes
All four findings were remediated within eight business days. Cert-X-Gen repeated the original probes against the updated running build and exercised the permitted workflows alongside them.
The restricted fetch was blocked before reaching the internal service. The unapproved message was not dispatched. Cross-workspace transcript access and connector use were denied, while authorized actions continued to work. Across these boundaries, 24 of 24 targeted remediation checks passed.
Those results described the tested build and conditions. They did not assert that every possible agent action or destination was safe.
Security Became Part of Shipping
The team wired Bravos into its release process. GuardLink's repository annotations exposed sensitive changes in pull requests, while Bravos orchestrated live assessment of release builds with authenticated test workspaces and controlled destinations.
Over the next six weeks, Bravos assessed 12 release builds. The scoped isolation, approval, and egress probes did not reproduce the four remediated failures on those builds. A check without a completed environment or observed result was not counted as a pass.
GuardLink and Cert-X-Gen are open source. Bravos brought them together with environment setup, attack-surface ranking, and evidence-backed reporting. For this team, the outcome was a repeatable release decision grounded in application behavior—not trust in the agent's intentions.