# Show HN: Lucin -static analysis for AI agents with published false-negative list > Source: > Published: 2026-08-03 15:03:08+00:00 # Your agent can be talked into anything. Lucin shows you what that costs. Other scanners read tool names and guess. Lucin reads the code inside every tool your agent can call and traces the exact path from a poisoned prompt to your data leaving the building — then hands you the cut that closes it. [See what it prints →](#output) ## Most scanners guess. Lucin proves. One model of the agent — the information-flow graph — used three ways. Reads the real code inside your tools. Maps every path from untrusted input to a dangerous action, with `file:line` . One command, no signup. For most teams this is the whole product, and it's free forever. The path SCAN flagged, enforced live. A deterministic gate on the flow — not the prompt — so the model can be fully compromised and still not exfiltrate. Attacks generated against your own tools, so a finding ships with proof it's real — and proof it's fixed. ## A finding you can act on in one read. Severity, the proof-witness path, the exact cut that closes it, and the line of code. Same finding, three surfaces. ``` bash $ lucin scan ./support-agent/ Target: ./support-agent/ (2 agents, 14 tools, 1 MCP server) Scan completed in 842ms ── SECURITY SCORE ───────────────────────────── ████████████░░░░░░░░ 62/100 — Needs attention ── RISK SUMMARY ─────────────────────────────── CRITICAL ███ 1 HIGH ██████ 2 MEDIUM ██████ 3 ── CRITICAL · AG-TRIFECTA ───────────────────── Untrusted input reaches an external sink Agent: support_agent Tool: post_webhook Proof: control: read_email → __llm__ → post_webhook data: query_customers → __llm__ → post_webhook Min-cut fix: restrict 1 tool to break every exfil path post_webhook (allow-list hosts, or require approval) OWASP: LLM06 Excessive Agency Location: agents/support.py:88 ``` `post_webhook` to an allow-listed host, or require approval before it fires. ``` - uses: Madhav2310/lucinlabs@v1 with: fail-on: critical format: sarif ────────────────────────────────────────────── Error: AG-TRIFECTA · agents/support.py:88 Untrusted input reaches an external sink read_email → __llm__ → post_webhook 1 critical, 2 high — 549 passing — SARIF uploaded to code scanning Process completed with exit code 1. ``` ## We publish the receipts. [Methodology →](/benchmarks/) Every number above regenerates from a committed command. Run them yourself — we'd rather you reproduce the numbers than trust our marketing. [What it misses →](/limits/) ## 17,600 actions. Two and a half days. Nobody watching the flow. Hugging Face, July 2026. Not a sophisticated exploit — one bad edge, traversed roughly 17,600 times over four days of logs because nothing was watching. Every agent you ship has the same skeleton. [Read the teardown →](/blog/hugging-face-agent-breach/) ## Writing on agent security. [All posts →](/blog/) [TEARDOWN29 JUL 2026 17,600 actions, 2.5 days: the Hugging Face agent breach, scanned What the incident looked like as an information-flow graph — and which single edge would have stopped it. ](/blog/hugging-face-agent-breach/) [METHOD29 JUL 2026 The lethal trifecta, as a graph problem Three capabilities are fine alone. Wired together they are an incident. Here is how to read the edges off your own tools. ](/blog/lethal-trifecta/) [PROOF29 JUL 2026 We published our false-positive rate. Here is the command Why a security tool that won't show you its benchmark harness is asking you to take its word for it. ](/blog/reproducible-benchmark/) ## Get GUARD before everyone else. We're taking a small number of design partners. Tell us what you're running; we reply within a day.