{"slug": "prismor-open-source-runtime-security-for-ai-coding-agents", "title": "Prismor: Open-Source Runtime Security for AI Coding Agents", "summary": "Prismor, formerly Immunity Agent, shipped this week as a self-hosted, open-source runtime control plane that intercepts and policy-checks every tool call made by AI coding agents including Claude Code, Codex, Cursor, and Windsurf before execution. The release follows Manifold Security's GitSpawn disclosure of eight vulnerabilities across seven agents, four of which remain unpatched, and arrives amid 37 supply-chain campaigns and 497 indexed malicious npm and PyPI packages in the first half of 2026 — 4.5 times the prior year's volume — plus GitGuardian's finding that AI-assisted commits leak secrets at 3.2% versus a 1.5% human-only baseline. Prismor installs via 'pip install prismor' and offers three governance modes: dev-safe (31% coverage, 9% friction), trusted-workspace (34% coverage, 25% friction), and regulated-airgap (100% coverage, 90% friction).", "body_md": "That’s not a hypothetical. When Claude Code opens a repository, it runs `git status` before you type anything. When your agent decides a dependency is missing, it installs it. The tool-approval prompt you’re trusting? It fires after the hook, not before. GitSpawn, disclosed last month, demonstrated this gap with eight vulnerabilities across seven agents — four of which remain unpatched today.\n\n**Prismor** (formerly Immunity Agent) shipped this week to close that gap. It’s a self-hosted, open-source runtime control plane that sits between your AI coding agent and every tool call it makes, checks each call against a policy before it executes, and either allows it, warns you, or blocks it outright. Claude Code, Codex, Cursor, and Windsurf are all supported from day one.\n\n## The Problem Is the Tool Call, Not the Agent\n\nResearchers from [Manifold Security](https://www.manifold.security/blog/ai-coding-agents-git-hijack) found that a malicious `.git/config` entry can run attacker-supplied commands the moment Claude Code executes `git status` — before the workspace-trust prompt, before any approval screen, before you know you cloned a hostile repository. That’s one of eight GitSpawn findings. Four are still open.\n\nSupply chain is worse. The first half of 2026 produced 37 campaigns and 497 indexed malicious packages across npm and PyPI — 4.5 times the volume of the entire prior year. GitGuardian’s 2026 data found that AI-assisted commits leak secrets at 3.2%, more than double the 1.5% baseline for human-only commits. There are 24,008 secrets sitting in public MCP configuration files on GitHub right now. Your agent doesn’t know which packages are poisoned. It installs what it thinks you need.\n\nPrismor’s answer: intercept every tool call before it runs, score it, and block the dangerous ones before they land.\n\n## Install It in Two Commands\n\nPrismor is on [PyPI](https://pypi.org/project/prismor/). Installation is a single pip command followed by an interactive setup wizard that takes about five minutes:\n\n```\npip install prismor\nprismor setup\n```\n\nThe setup wizard asks you to pick an enforcement mode, choose which detection rules apply, select which agents to hook, and enable secret cloaking — which strips credentials from tool-call payloads before the agent sends them. At the end, Prismor wires itself into whichever agents it detects on your machine automatically. Alternatively:\n\n```\ncurl -sSL https://prismor.dev/install | sh\nprismor setup\n```\n\n## Three Postures, Not a Wall of Settings\n\nInstead of asking you to configure six policy axes from scratch, Prismor’s setup offers three named [governance modes](https://www.prismor.dev/docs/modes). Each compiles into a `policy.yaml` you can edit manually if needed.\n\n| Posture | Coverage | Friction | Best For | \n|---|---|---|---|\n| **dev-safe** | 31% | 9% | Unfamiliar codebases | \n| **trusted-workspace** | 34% | 25% | Personal repos | \n| **regulated-airgap** | 100% | 90% | CI/CD, regulated envs | \n\n**dev-safe** is the one most developers should start with. It blocks secret exfiltration, secrets in payloads, destructive commands, and supply chain attacks at 9% friction. An injected agent cannot reach unlisted hosts to exfiltrate your data. This is the five-minute install for any developer who runs Claude Code or Cursor against unfamiliar codebases.\n\n**regulated-airgap** cuts off network and shell access entirely — 100% coverage. Use this for CI/CD pipelines in regulated environments, not everyday development.\n\n## Supply Chain and MCP Protection\n\nPrismor wraps npm and pip. When an agent tries to install a package, Prismor scores it on four axes: package age, maintainer count, install scripts, and known indicators of compromise. A score at or above 60 blocks the install. A known IOC match always blocks, regardless of score.\n\nFor MCP specifically, Prismor includes an MCP Gateway — a single connector that fronts every MCP server you use. Each tool call is policy-evaluated before forwarding, and each server response is injection-scanned before the model sees it. A poisoned tool result never becomes part of the model’s context.\n\nThe whole thing adds 0.8 milliseconds per tool call across 10,000 simulated agent sessions. You won’t notice it.\n\n## Install dev-safe Today\n\nThere’s a common assumption that tool-approval prompts are enough — that reviewing what the agent proposes to do is sufficient security. That assumption is wrong. Prompts appear after hooks fire. Some actions execute before any confirmation screen. The ecosystem moves faster than trust models can keep up.\n\nPrismor is Apache-2.0, self-hosted, and keeps all session data on your machine. No cloud dependency, no per-seat pricing, no vendor lock-in. The [GitHub repository](https://github.com/PrismorSec/prismor) has the source code and full policy reference. The [quickstart](https://www.prismor.dev/docs/quickstart) gets you from zero to a hooked agent in five minutes.\n\nIf you’re running any AI coding agent today, dev-safe is the floor. Start there.", "url": "https://wpnews.pro/news/prismor-open-source-runtime-security-for-ai-coding-agents", "canonical_source": "https://byteiota.com/prismor-open-source-runtime-security-for-ai-coding-agents/", "published_at": "2026-09-27 22:22:42+00:00", "updated_at": "2026-09-27 22:29:42.518172+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-tools", "ai-infrastructure"], "entities": ["Prismor", "Immunity Agent", "Claude Code", "Codex", "Cursor", "Windsurf", "Manifold Security", "GitGuardian"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/prismor-open-source-runtime-security-for-ai-coding-agents", "markdown": "https://wpnews.pro/news/prismor-open-source-runtime-security-for-ai-coding-agents.md", "text": "https://wpnews.pro/news/prismor-open-source-runtime-security-for-ai-coding-agents.txt", "jsonld": "https://wpnews.pro/news/prismor-open-source-runtime-security-for-ai-coding-agents.jsonld"}}