{"slug": "show-hn-lucin-static-analysis-for-ai-agents-with-published-false-negative-list", "title": "Show HN: Lucin -static analysis for AI agents with published false-negative list", "summary": "Lucin, a static analysis tool for AI agents, launched on Hacker News with a published false-negative list and a reproducible benchmark, claiming to trace poisoned prompts to data exfiltration paths with file:line precision. The tool's scan of a sample support agent found 1 critical, 2 high, and 3 medium risks in 842ms, and it offers a free forever tier for most teams. Lucin also references a July 2026 Hugging Face agent breach involving 17,600 actions over 2.5 days, which it says could have been stopped by monitoring a single edge.", "body_md": "# Your agent can be talked into anything. Lucin shows you what that costs.\n\nOther scanners read tool names and guess. Lucin reads the code inside every tool your agent can call and traces the exact path from a poisoned prompt to your data leaving the building — then hands you the cut that closes it.\n\n[See what it prints →](#output)\n\n## Most scanners guess. Lucin proves.\n\nOne model of the agent — the information-flow graph — used three ways.\n\nReads the real code inside your tools. Maps every path from untrusted input to a dangerous action, with `file:line`\n\n. One command, no signup. For most teams this is the whole product, and it's free forever.\n\nThe path SCAN flagged, enforced live. A deterministic gate on the flow — not the prompt — so the model can be fully compromised and still not exfiltrate.\n\nAttacks generated against your own tools, so a finding ships with proof it's real — and proof it's fixed.\n\n## A finding you can act on in one read.\n\nSeverity, the proof-witness path, the exact cut that closes it, and the line of code. Same finding, three surfaces.\n\n``` bash\n$ lucin scan ./support-agent/\n\n Target: ./support-agent/ (2 agents, 14 tools, 1 MCP server)\n Scan completed in 842ms\n\n ── SECURITY SCORE ─────────────────────────────\n ████████████░░░░░░░░  62/100 — Needs attention\n\n ── RISK SUMMARY ───────────────────────────────\n CRITICAL  ███       1\n HIGH      ██████    2\n MEDIUM    ██████    3\n\n ── CRITICAL · AG-TRIFECTA ─────────────────────\n Untrusted input reaches an external sink\n Agent: support_agent   Tool: post_webhook\n\n Proof:\n   control: read_email → __llm__ → post_webhook\n   data:    query_customers → __llm__ → post_webhook\n\n Min-cut fix: restrict 1 tool to break every exfil path\n   post_webhook  (allow-list hosts, or require approval)\n\n OWASP: LLM06 Excessive Agency\n Location: agents/support.py:88\n```\n\n`post_webhook`\n\nto an allow-listed host, or require approval before it fires.\n\n```\n- uses: Madhav2310/lucinlabs@v1\n  with:\n    fail-on: critical\n    format: sarif\n\n──────────────────────────────────────────────\nError: AG-TRIFECTA · agents/support.py:88\n  Untrusted input reaches an external sink\n  read_email → __llm__ → post_webhook\n\n1 critical, 2 high — 549 passing — SARIF uploaded to code scanning\nProcess completed with exit code 1.\n```\n\n## We publish the receipts.\n\n[Methodology →](/benchmarks/)\n\nEvery number above regenerates from a committed command. Run them yourself — we'd rather you reproduce the numbers than trust our marketing. [What it misses →](/limits/)\n\n## 17,600 actions. Two and a half days. Nobody watching the flow.\n\nHugging Face, July 2026. Not a sophisticated exploit — one bad edge, traversed roughly 17,600 times over four days of logs because nothing was watching. Every agent you ship has the same skeleton.\n\n[Read the teardown →](/blog/hugging-face-agent-breach/)\n\n## Writing on agent security.\n\n[All posts →](/blog/)\n\n[TEARDOWN29 JUL 2026\n17,600 actions, 2.5 days: the Hugging Face agent breach, scanned\nWhat the incident looked like as an information-flow graph — and which single edge would have stopped it.\n](/blog/hugging-face-agent-breach/)\n\n[METHOD29 JUL 2026\nThe lethal trifecta, as a graph problem\nThree capabilities are fine alone. Wired together they are an incident. Here is how to read the edges off your own tools.\n](/blog/lethal-trifecta/)\n\n[PROOF29 JUL 2026\nWe published our false-positive rate. Here is the command\nWhy a security tool that won't show you its benchmark harness is asking you to take its word for it.\n](/blog/reproducible-benchmark/)\n\n## Get GUARD before everyone else.\n\nWe're taking a small number of design partners. Tell us what you're running; we reply within a day.", "url": "https://wpnews.pro/news/show-hn-lucin-static-analysis-for-ai-agents-with-published-false-negative-list", "canonical_source": "https://lucin.pages.dev/", "published_at": "2026-08-03 15:03:08+00:00", "updated_at": "2026-08-03 15:23:16.281611+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools", "ai-tools"], "entities": ["Lucin", "Hugging Face", "Madhav2310/lucinlabs@v1"], "alternates": {"html": "https://wpnews.pro/news/show-hn-lucin-static-analysis-for-ai-agents-with-published-false-negative-list", "markdown": "https://wpnews.pro/news/show-hn-lucin-static-analysis-for-ai-agents-with-published-false-negative-list.md", "text": "https://wpnews.pro/news/show-hn-lucin-static-analysis-for-ai-agents-with-published-false-negative-list.txt", "jsonld": "https://wpnews.pro/news/show-hn-lucin-static-analysis-for-ai-agents-with-published-false-negative-list.jsonld"}}