Show HN: Lucin -static analysis for AI agents with published false-negative list

Lucin, a static analysis tool for AI agents, launched on Hacker News with a published false-negative list and a reproducible benchmark, claiming to trace poisoned prompts to data exfiltration paths with file:line precision. The tool's scan of a sample support agent found 1 critical, 2 high, and 3 medium risks in 842ms, and it offers a free forever tier for most teams. Lucin also references a July 2026 Hugging Face agent breach involving 17,600 actions over 2.5 days, which it says could have been stopped by monitoring a single edge.

Your agent can be talked into anything. Lucin shows you what that costs. Other scanners read tool names and guess. Lucin reads the code inside every tool your agent can call and traces the exact path from a poisoned prompt to your data leaving the building — then hands you the cut that closes it. See what it prints → output Most scanners guess. Lucin proves. One model of the agent — the information-flow graph — used three ways. Reads the real code inside your tools. Maps every path from untrusted input to a dangerous action, with file:line . One command, no signup. For most teams this is the whole product, and it's free forever. The path SCAN flagged, enforced live. A deterministic gate on the flow — not the prompt — so the model can be fully compromised and still not exfiltrate. Attacks generated against your own tools, so a finding ships with proof it's real — and proof it's fixed. A finding you can act on in one read. Severity, the proof-witness path, the exact cut that closes it, and the line of code. Same finding, three surfaces. bash $ lucin scan ./support-agent/ Target: ./support-agent/ 2 agents, 14 tools, 1 MCP server Scan completed in 842ms ── SECURITY SCORE ───────────────────────────── ████████████░░░░░░░░ 62/100 — Needs attention ── RISK SUMMARY ─────────────────────────────── CRITICAL ███ 1 HIGH ██████ 2 MEDIUM ██████ 3 ── CRITICAL · AG-TRIFECTA ───────────────────── Untrusted input reaches an external sink Agent: support agent Tool: post webhook Proof: control: read email → llm → post webhook data: query customers → llm → post webhook Min-cut fix: restrict 1 tool to break every exfil path post webhook allow-list hosts, or require approval OWASP: LLM06 Excessive Agency Location: agents/support.py:88 post webhook to an allow-listed host, or require approval before it fires. - uses: Madhav2310/lucinlabs@v1 with: fail-on: critical format: sarif ────────────────────────────────────────────── Error: AG-TRIFECTA · agents/support.py:88 Untrusted input reaches an external sink read email → llm → post webhook 1 critical, 2 high — 549 passing — SARIF uploaded to code scanning Process completed with exit code 1. We publish the receipts. Methodology → /benchmarks/ Every number above regenerates from a committed command. Run them yourself — we'd rather you reproduce the numbers than trust our marketing. What it misses → /limits/ 17,600 actions. Two and a half days. Nobody watching the flow. Hugging Face, July 2026. Not a sophisticated exploit — one bad edge, traversed roughly 17,600 times over four days of logs because nothing was watching. Every agent you ship has the same skeleton. Read the teardown → /blog/hugging-face-agent-breach/ Writing on agent security. All posts → /blog/ TEARDOWN29 JUL 2026 17,600 actions, 2.5 days: the Hugging Face agent breach, scanned What the incident looked like as an information-flow graph — and which single edge would have stopped it. /blog/hugging-face-agent-breach/ METHOD29 JUL 2026 The lethal trifecta, as a graph problem Three capabilities are fine alone. Wired together they are an incident. Here is how to read the edges off your own tools. /blog/lethal-trifecta/ PROOF29 JUL 2026 We published our false-positive rate. Here is the command Why a security tool that won't show you its benchmark harness is asking you to take its word for it. /blog/reproducible-benchmark/ Get GUARD before everyone else. We're taking a small number of design partners. Tell us what you're running; we reply within a day.