Project AIR is an open-source toolkit that keeps a tamper-proof record of what AI agents do. Every action an agent takes gets signed, chained to the step before it, and tied to the person who authorized it. The chain is anchored to Sigstore Rekor, a public transparency log, so anyone can check later that nothing was changed or deleted. When something goes wrong, you can show exactly what happened and who approved it, instead of just saying it happened.

It also runs 16 detectors over every record, covering all ten risks on the OWASP Top 10 for Agentic Applications, three from the OWASP list for LLM apps, and three of its own. It can stop an agent mid-action until a person signs off. It plugs into LangChain, LlamaIndex, and the OpenAI, Anthropic and Gemini SDKs with a line or two of code.

I built the Python library and command-line tool, published on PyPI as projectair (now at version 1.3.1) under the Apache 2.0 license, plus the website and dashboard in SvelteKit. We run it on our own infrastructure too: every request to vindicara.io is recorded and anchored to Rekor every minute.

Impressive work! 👏 Excellent approach to AI agent security, tamper-proof audit trails, and human oversight for more trustworthy AI systems.

Agents on Offense: AI Hacks 100+ Sites, a CLI Gets Backdoored and DeepSeek Gets Banned 1Day Agency Tech Brief · October 20, 2026 AI agents are now cheap enough to attack at scale, and cheap enough to run your business. In the last 24 hours, one hacker showed what $5,000 of tokens can break, a cloud provider's own CLI shipped malware, Washington pulled DeepSeek out of civilian agencies, and the price of a capable agent model dropped again. Here's what mattered. — 1. One hacker, an army of AI agents, 100+ breached company sites What happened: Reuters reports that a Chinese-speaking hacker used AI agents to break into websites of more than 100 companies, including Deere, SharkNinja and Cummins. The agents probed and exploited vulnerabilities largely on their own. Successful intrusions took about 23 hours and roughly $50 each, and the whole campaign used about $5,000 in AI tokens. Reuters could not determine how much data was taken. Why it matters: The cost of a targeted attack just collapsed. Small and mid-sized companies can no longer assume they're too small to be worth a hacker's time. Source: Reuters, via Yahoo News (https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html) 2. OVHcloud's official CLI was backdoored on GitHub What happened: An attacker hijacked a developer's GitHub account and replaced OVHcloud CLI releases v0.11.0 through v0.15.0 with builds that steal secrets from disk. CEO Octave Klaba said the bad release went up at 14:47 on Oct. 19 and was blocked at 16:21 after a customer report. GitHub's release immutability setting was off, so existing releases could be changed without going through CI/CD. Researchers at OpenSourceMalware tie it to the GlassWorm campaign, which uses a Solana memo as a dead drop. Versions 0.10.0 and 0.16.0 are clean. Why it matters: Your CI can be perfect and you still ship malware if release assets can be swapped. Turn on release immutability and treat any machine that ran a bad binary as fully compromised. Source: BleepingComputer (https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/) 3. DHS orders DeepSeek out of US federal civilian systems What happened: The Department of Homeland Security published an order requiring federal civilian agencies to remove DeepSeek products, including third-party products built on DeepSeek implementations, and barring future purchases. The order was signed July 24 and made public this week. It cites possible transfer of government data to China and security flaws in DeepSeek's models. It does not cover Defense or intelligence systems, and agencies can request exceptions. Why it matters: "Built on open weights" is now a compliance question. Vendors selling to the US government will need to show what their product is actually running. Sources: Federal Register (https://www.federalregister.gov/documents/2026/10/20/2026-21447/notice-of-order-regarding-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive) · CNBC (https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html) 4. MiniMax M3.1 Flash cuts agent costs by 70% What happened: China's MiniMax released M3.1 Flash, a 428B-parameter model with a 1M-token context, built for agents, coding, computer use and security work. Pricing is $0.15 per million input tokens and $0.60 per million output. MiniMax says agent tasks cost 70% less than on its previous model and run nearly three times faster. It also confirmed that "Space Bunny," the anonymous model on OpenRouter, was an early build. Weights are due later; benchmark figures are company-reported. Why it matters: Agent workflows make dozens of model calls per task. At these prices, the model bill stops being the reason not to automate. Sources: MiniMax (https://www.minimax.io/blog/minimax-m31f) · SiliconANGLE (https://siliconangle.com/2026/10/19/minimax-launches-m3-1-flash-model-says-it-cuts-ai-agent-costs-by-70/) 5. Meta opens the doors on Prometheus, its gigawatt AI supercluster What happened: Meta detailed Prometheus, its gigawatt-scale AI supercluster in New Albany, Ohio. Phase one is complete and trained its Muse models, and Meta is scaling it toward roughly one million GPUs on Nvidia GB200 and GB300 NVL72 systems. Meta says joint work with Nvidia on reliability cut training interruptions by 99%. Why it matters: At this scale, uptime and failure recovery are the product. The race isn't just more GPUs, it's keeping them all working at once. Source: StorageReview (https://www.storagereview.com/news/meta-prometheus-gigawatt-supercluster-1-million-gpus-gb200-gb300-nvl72) — 𝘖𝘶𝘳 𝘵𝘢𝘬𝘦 — 1𝘋𝘢𝘺 𝘈𝘨𝘦𝘯𝘤𝘺 𝘛𝘩𝘦 𝘴𝘢𝘮𝘦 𝘢𝘨𝘦𝘯𝘵𝘴 𝘵𝘩𝘢𝘵 𝘤𝘢𝘯 𝘳𝘶𝘯 𝘺𝘰𝘶𝘳 𝘣𝘶𝘴𝘪𝘯𝘦𝘴𝘴 𝘤𝘢𝘯 𝘯𝘰𝘸 𝘢𝘵𝘵𝘢𝘤𝘬 𝘪𝘵, 𝘧𝘰𝘳 𝘢𝘣𝘰𝘶𝘵 $50 𝘢 𝘵𝘢𝘳𝘨𝘦𝘵. 𝘛𝘰𝘥𝘢𝘺'𝘴 𝘯𝘦𝘸𝘴 𝘪𝘴 𝘵𝘸𝘰 𝘴𝘪𝘥𝘦𝘴 𝘰𝘧 𝘰𝘯𝘦 𝘤𝘰𝘪𝘯. 𝘈𝘨𝘦𝘯𝘵 𝘮𝘰𝘥𝘦𝘭𝘴 𝘨𝘰𝘵 𝘤𝘩𝘦𝘢𝘱𝘦𝘳 𝘢𝘯𝘥 𝘧𝘢𝘴𝘵𝘦𝘳, 𝘢𝘯𝘥 𝘢𝘵𝘵𝘢𝘤𝘬𝘦𝘳𝘴 𝘯𝘰𝘵𝘪𝘤𝘦𝘥 𝘧𝘪𝘳𝘴𝘵. 𝘈 𝘴𝘪𝘯𝘨𝘭𝘦 𝘱𝘦𝘳𝘴𝘰𝘯 𝘸𝘪𝘵𝘩 𝘢 𝘧𝘦𝘸 𝘵𝘩𝘰𝘶𝘴𝘢𝘯𝘥 𝘥𝘰𝘭𝘭𝘢𝘳𝘴 𝘰𝘧 𝘵𝘰𝘬𝘦𝘯𝘴 𝘣𝘳𝘰𝘬𝘦 𝘪𝘯𝘵𝘰 𝘮𝘰𝘳𝘦 𝘵𝘩𝘢𝘯 100 𝘤𝘰𝘮𝘱𝘢𝘯𝘪𝘦𝘴, 𝘸𝘩𝘪𝘭𝘦 𝘢 𝘵𝘳𝘶𝘴𝘵𝘦𝘥 𝘊𝘓𝘐 𝘲𝘶𝘪𝘦𝘵𝘭𝘺 𝘵𝘶𝘳𝘯𝘦𝘥 𝘪𝘯𝘵𝘰 𝘢 𝘴𝘦𝘤𝘳𝘦𝘵 𝘴𝘵𝘦𝘢𝘭𝘦𝘳. 𝘛𝘩𝘢𝘵'𝘴 𝘸𝘩𝘺 𝘸𝘦 𝘣𝘶𝘪𝘭𝘥 𝘠𝘷𝘪𝘰𝘯 𝘵𝘩𝘦 𝘸𝘢𝘺 𝘸𝘦 𝘥𝘰: 𝘌𝘙𝘗, 𝘊𝘙𝘔 𝘢𝘯𝘥 𝘶𝘴𝘦𝘳 𝘮𝘰𝘯𝘪𝘵𝘰𝘳𝘪𝘯𝘨 𝘸𝘪𝘵𝘩 𝘴𝘦𝘤𝘳𝘦𝘵𝘴 𝘪𝘯 𝘢 𝘷𝘢𝘶𝘭𝘵, 𝘴𝘪𝘨𝘯𝘦𝘥 𝘢𝘯𝘥 𝘭𝘰𝘤𝘬𝘦𝘥 𝘳𝘦𝘭𝘦𝘢𝘴𝘦𝘴, 𝘭𝘦𝘢𝘴𝘵-𝘱𝘳𝘪𝘷𝘪𝘭𝘦𝘨𝘦 𝘢𝘤𝘤𝘦𝘴𝘴 𝘧𝘰𝘳 𝘦𝘷𝘦𝘳𝘺 𝘢𝘨𝘦𝘯𝘵, 𝘢𝘯𝘥 𝘢 𝘩𝘶𝘮𝘢𝘯 𝘢𝘱𝘱𝘳𝘰𝘷𝘢𝘭 𝘴𝘵𝘦𝘱 𝘣𝘦𝘧𝘰𝘳𝘦 𝘢𝘯𝘺𝘵𝘩𝘪𝘯𝘨 𝘳𝘪𝘴𝘬𝘺 𝘩𝘢𝘱𝘱𝘦𝘯𝘴. 𝘍𝘰𝘳 𝘈𝘐 𝘢𝘯𝘥 𝘞𝘦𝘣3 𝘤𝘭𝘪𝘦𝘯𝘵𝘴, 𝘰𝘶𝘳 𝘳𝘶𝘭𝘦 𝘪𝘴 𝘴𝘪𝘮𝘱𝘭𝘦: 𝘪𝘧 𝘢𝘯 𝘢𝘨𝘦𝘯𝘵 𝘤𝘢𝘯 𝘢𝘤𝘵, 𝘪𝘵 𝘮𝘶𝘴𝘵 𝘣𝘦 𝘴𝘤𝘰𝘱𝘦𝘥, 𝘭𝘰𝘨𝘨𝘦𝘥 𝘢𝘯𝘥 𝘴𝘵𝘰𝘱𝘱𝘢𝘣𝘭𝘦. 𝘊𝘩𝘦𝘢𝘱 𝘪𝘯𝘵𝘦𝘭𝘭𝘪𝘨𝘦𝘯𝘤𝘦 𝘪𝘴 𝘢 𝘨𝘪𝘧𝘵. 𝘜𝘯𝘴𝘶𝘱𝘦𝘳𝘷𝘪𝘴𝘦𝘥 𝘪𝘯𝘵𝘦𝘭𝘭𝘪𝘨𝘦𝘯𝘤𝘦 𝘪𝘴 𝘢 𝘭𝘪𝘢𝘣𝘪𝘭𝘪𝘵𝘺. Want this applied to your business? Message us here on Contra.