Lucin — Your agent can be talked into anything
Skip to content
ONE MODEL, THREE WAYS TO USE IT
Most scanners guess. Lucin proves.
One model of the agent — the information-flow graph — used three ways.
SCAN · free, MIT
Reads the real code inside your tools. Maps every path from untrusted input to a dangerous action, with file:line. One command, no signup. For most teams this is the whole product, and it's free forever.
GUARD · preview
The path SCAN flagged, enforced live. A deterministic gate on the flow — not the prompt — so the model can be fully compromised and still not exfiltrate.
PROVE · experimental
Attacks generated against your own tools, so a finding ships with proof it's real — and proof it's fixed.
WHAT YOU ACTUALLY GET
A finding you can act on in one read.
Severity, the proof-witness path, the exact cut that closes it, and the line of code. Same finding, three surfaces.
terminal<br>html report<br>ci
lucin scan ./support-agent/
$ lucin scan ./support-agent/
Target: ./support-agent/ (2 agents, 14 tools, 1 MCP server)<br>Scan completed in 842ms
── SECURITY SCORE ─────────────────────────────<br>████████████░░░░░░░░ 62/100 — Needs attention
── RISK SUMMARY ───────────────────────────────<br>CRITICAL ███ 1<br>HIGH ██████ 2<br>MEDIUM ██████ 3
── CRITICAL · AG-TRIFECTA ─────────────────────<br>Untrusted input reaches an external sink<br>Agent: support_agent Tool: post_webhook
Proof:<br>control: read_email → __llm__ → post_webhook<br>data: query_customers → __llm__ → post_webhook
Min-cut fix: restrict 1 tool to break every exfil path<br>post_webhook (allow-list hosts, or require approval)
OWASP: LLM06 Excessive Agency<br>Location: agents/support.py:88
lucin-report.htmllucin scan . --format html
62/100
Needs attention
Critical
High
Medium
Low
2 agents · 14 tools<br>1 MCP server · 842ms
CRITICAL<br>Untrusted input reaches an external sink<br>AG-TRIFECTA
read_email→<br>__llm__→<br>post_webhook
Min-cut fix: restrict post_webhook to an allow-listed host, or require approval before it fires.
agents/support.py:88
HIGH<br>Tool executes shell input without a boundary<br>AG-011
HIGH<br>Secret-bearing env read reachable from retrieval<br>AG-002
+ 7 moreinteractive flow graph below the fold
.github/workflows/security.yml<br>exit 1 — blocked
- uses: Madhav2310/lucinlabs@v1<br>with:<br>fail-on: critical<br>format: sarif
──────────────────────────────────────────────<br>Error: AG-TRIFECTA · agents/support.py:88<br>Untrusted input reaches an external sink<br>read_email → __llm__ → post_webhook
1 critical, 2 high — 549 passing — SARIF uploaded to code scanning<br>Process completed with exit code 1.
BENCHMARKS
We publish the receipts.
Methodology →
false positives we could not defend
52 real repositories, 2,732 files, adjudicated per-finding
On a wider unscoped population the same method estimates<br>100% precision. Both numbers, and why they differ,<br>are in the methodology.
benchmarks/build_benign_corpus.py
76%
recall on labelled vulns
50 held-out cases, 10 classes
benchmarks/recall_corpus.py
27
active detectors
every rule mapped to OWASP Agentic; 7 also to MITRE ATLAS
lucin scan --list-rules
frameworks supported
LangChain, CrewAI, AutoGen, MCP…
lucin scan --list-adapters
Every number above regenerates from a committed command. Run them yourself — we'd rather you reproduce the numbers than trust our marketing. What it misses →
WHY NOW
17,600 actions. Two and a half days. Nobody watching the flow.
Hugging Face, July 2026. Not a sophisticated exploit — one bad edge, traversed roughly 17,600 times over four days of logs because nothing was watching. Every agent you ship has the same skeleton.
Read the teardown →
FIELD NOTES
Writing on agent security.
All posts →
TEARDOWN29 JUL 2026
17,600 actions, 2.5 days: the Hugging Face agent breach, scanned
What the incident looked like as an information-flow graph — and which single edge would have stopped it.
METHOD29 JUL 2026
The lethal trifecta, as a graph problem
Three capabilities are fine alone. Wired together they are an incident. Here is how to read the edges off your own tools.
PROOF29 JUL 2026
We published our false-positive rate. Here is the command
Why a security tool that won't show you its benchmark harness is asking you to take its word for it.
Get GUARD before everyone else.
We're taking a small number of design partners. Tell us what you're running; we reply within a day.
Got it. We'll be in touch within a day.
Name
Work email
What are you running?
What are you running?<br>LangChain / LangGraph<br>CrewAI<br>MCP servers<br>Something else
Request access