AI News
商业产业 Hacker News AI 2026-08-28T14:47 正文 ok 911 words

🔶 Grith 正式上线：面向 AI 编程 Agent 的安全代理

英文标题：🔶 Grith is live – security proxy for AI coding agents

Grith 发布 0.3.2 版本，现已支持 Linux x86_64 与 arm64，代码库以 MPL-2.0 协议公开，核心安全能力免费提供。它通过 Linux 的 ptrace 与 seccomp-BPF 拦截 AI 编程 Agent 的文件、进程和网络相关系统调用，并以 18 个确定性过滤器进行评分，不在执行路径中使用 LLM。开发者可在 Claude Code、Codex、Aider、Cline 或 Goose 下方部署该监督器，以队列审核或阻断高风险操作，同时保留本地审计日志。该项目也明确其边界：它可检测已知的权限委托逃逸路径，但不能替代针对完全不受信任代码的虚拟机或容器隔离。
打开原文相关 6 · 机会 1
media52.8 KB

中文

grith 已正式上线。0.3.2 版本现可在 Linux x86_64 和 arm64 上安装，代码库以 MPL-2.0 协议公开，安全核心免费提供。

如果你在 Linux 上运行 Claude Code、Codex、Aider、Cline 或 Goose，只需两分钟即可在其底层部署一个监督器。

它是什么

AI 编程 Agent 会在执行操作前请求授权，但多数人最终都会开启自动批准，因为每小时审查 40 个提示并不是一种可行的工作流。此时，Agent 实际上是在批准自己的操作；而执行批准的又是同一个概率模型，可能被被投毒的 README 或巧妙的提示注入所操纵。

grith 采取不同立场：安全决策不应存在于被保护对象内部。它是一个操作系统级监督器。在 Linux 上，它利用 ptrace 和 seccomp-BPF 预过滤器拦截与安全相关的系统调用——文件访问、进程执行和网络操作——并通过三个阶段的 18 个过滤器对其评分：静态检查、模式匹配（包含 1,618 条模式的密钥扫描、出站策略、破坏性操作检测），随后是污点跟踪等上下文过滤器。匹配层是确定性的，执行路径中没有 LLM。

始终明确给出三种裁决：

  • ✓ ALLOW（评分低于 3.0）——调用继续执行
  • ⏸ QUEUE（3.0 至 8.0）——进程冻结，直到人工完成审核
  • ⛔ DENY（高于 8.0）——向系统调用返回值注入 EPERM

不会有“也许可以”的执行。评分中位耗时为 0.02ms，因此那些你从未想人工审核的常规调用不会干扰你。

试用方式

curl -fsSL https://grith.ai/install | sh

然后封装你已经在使用的工具：

grith exec -- claude-code "fix the bug"

claude-code、codex、aider、goose、cline 等工具均有预构建配置文件，可自动允许各工具的常规操作，因此审核队列只会显示值得人工关注的调用。它还提供内置 Agent 模式（grith run "fix the tests"），可将任何兼容 OpenAI 的 API 或本地 Ollama 模型接入同一条管线——相同的过滤器、相同的阈值、相同的审计日志。

迄今为止发布了什么

近期版本主要用于堵住我们自身的逃逸路径，并扩大 grith 的运行范围：

  • v0.2.2 移除了冷启动时的阈值放宽机制。会话中的第一次调用与第一千次调用采用完全相同的评分方式。
  • v0.2.3 新增对监督逃逸类别的执行保护：权限委托型启动（systemd-run、docker、tmux、crontab 等）以及控制注入型套接字连接（会话 D-Bus、tmux、X11）。
  • v0.2.4 发布原生 Linux arm64 支持，不再让启动目录信任范围覆盖凭据存储，并让代理对文件重命名的目标路径评分，而不只是源路径。
  • v0.2.5 默认启用上述逃逸路径执行保护。若一个监督器在发布时禁用了最关键的保护能力，我们不会运行它。它会升级至审核队列，而非直接拒绝；docker ps 这类只读调用永远不会触发提示。非交互式会话会采取安全失败策略并予以拒绝，因此，确实需要委托权限的 CI 脚本需要在配置文件中添加允许条目——这一取舍以及我们尚未弥合的缺口，都记录在 CHANGELOG 中。
  • v0.3.0 增加了隐私保护的团队分析、仅限工作区的共享功能，以及 D-Bus 控制套接字覆盖。
  • v0.3.1 增加了可验证的每日分析归档，并在不削弱拒绝决策的前提下降低提示噪声。
  • v0.3.2 使出站速率状态能够感知操作结果。被拒绝导致的重试风暴不再被计为已发送流量，但针对被封锁目的地的重复扩散行为仍会在策略中保持可见。

CHANGELOG 和安全策略也记录了我们尚未弥合的缺口。受监督的进程树是执行边界；向该树之外、预先存在的进程委托权限，属于一种结构性逃逸类别。grith 会检测已知的委托路径，包括常见控制套接字和委托型二进制程序，但并不声称可以替代用于运行完全不受信任代码的虚拟机或容器。

哪些内容免费

完整的安全核心将永久免费：代理、全部 18 个过滤器、监督器、隔离摘要、本地 SQLite 审计日志、CLI，以及位于 localhost:3141 的仪表板。无需账户，不会回传数据，可完全离线使用，并且可自带模型密钥。免费层最多支持 2 个并发受监督会话；过滤器本身没有限制。

代码库采用 MPL-2.0 协议。付费层通过签名许可证解锁团队功能——共享策略与配置、提供商密钥同步、团队分析和可验证的每日归档。

发布版本附带 cosign 无密钥签名、SLSA 来源证明、CycloneDX SBOM 和 SHA-256 校验和；二进制文件为静态 musl 构建，你也可以自行构建。

范围，明确说明

目前仅支持 Linux：x86_64（内核 4.8+）和 aarch64（内核 5.3+，于 v0.2.4 发布）——因此 Graviton 和 Ampere 实例、arm64 VPS，以及运行 64 位操作系统的 Raspberry Pi 4 或 5 均可使用。macOS（通过 Endpoint Security 框架）和 Windows（通过 ETW）属于 v2.0 的工作范围。安装脚本会在不受支持的平台上清晰报错，而不会假装可以运行。

为什么我们认为这一层必须存在

我们并非从产品论点出发，而是从追踪记录开始。在相同任务下通过 strace 运行 Claude Code 和 Codex 时，Claude Code 在一次基准测试中尝试读取 /proc/*/environ 达 752 次——方法论和脚本已公开。后来，在内部试用期间，grith 冻结了一个 Codex 会话：它在执行常规任务时开始扫描整个磁盘以寻找凭据。

这并非恶意行为，而只是具备强大能力的 Agent 拥有你整台机器所赋予的环境权限，而此前其下方没有任何监督层。

我们希望你做什么

攻破它。无论是队列阈值、配置文件，还是我们遗漏的逃逸类别——请提交 issue，或回复我们发布的任何内容。如果你希望支持 macOS，可以在置顶 issue 中登记意愿，让我们能基于真实数据确定优先级。

English / 原文

grith is live. Version 0.3.2 is installable today on Linux x86_64 and arm64, the repository is public under MPL-2.0, and the security core is free.

If you run Claude Code, Codex, Aider, Cline, or Goose on Linux, you can put a supervisor underneath it in the next two minutes.

What it is

AI coding agents ask permission before acting, and then most of us switch on auto-approve, because reviewing forty prompts an hour is not a workflow. At that point the agent is approving its own actions, and the thing doing the approving is the same probabilistic model that a poisoned README or a clever prompt injection can steer.

grith takes a different position: the security decision should not live inside the thing being secured. It is an OS-level supervisor. On Linux it uses ptrace with a seccomp-BPF pre-filter to intercept security-relevant syscalls - file access, process execution, and network operations - and scores them against 18 filters in three phases: static checks, pattern matching (secret scanning with 1,618 patterns, egress policy, destructive-op detection), then contextual filters like taint tracking. The matching layers are deterministic, and there is no LLM in the enforcement path.

Three verdicts, always spelled out:

  • ✓ ALLOW (score under 3.0) - the call proceeds
  • ⏸ QUEUE (3.0 to 8.0) - the process freezes until a human reviews it
  • ⛔ DENY (over 8.0) - EPERM is injected into the syscall return

Nothing runs on a maybe. Median scoring time is 0.02ms, so the routine calls you never wanted to review stay out of your way.

Try it

curl -fsSL https://grith.ai/install | sh

Then wrap the tool you already use:

grith exec -- claude-code "fix the bug"

Pre-built profiles for claude-code, codex, aider, goose, cline, and others auto-allow each tool's routine operations, so the queue only sees the calls worth a human's attention. There is also a built-in agent mode (grith run "fix the tests") that routes any OpenAI-compatible API or local Ollama model through the same pipeline - same filters, same thresholds, same audit log.

What shipped on the way here

The recent releases were about closing our own escape routes and widening where grith runs:

  • v0.2.2 removed cold-start threshold widening. The first call in a session is scored exactly like the thousandth.
  • v0.2.3 added enforcement for supervision-escape classes: authority- delegating spawns (systemd-run, docker, tmux, crontab and friends) and control-injection socket connects (session D-Bus, tmux, X11).
  • v0.2.4 shipped native Linux arm64 support, stopped launch-directory trust from covering credential stores, and made the proxy score a file rename's destination, not just its source.
  • v0.2.5 turned that escape enforcement on by default. A supervisor that ships its sharpest protections disabled is not one we would run. It escalates to the review queue rather than denying outright, and read-only invocations like docker ps never prompt. Non-interactive sessions fail safe and deny, so a CI script that legitimately delegates needs a profile permit entry - that trade is in the CHANGELOG, along with the gaps we have not closed.
  • v0.3.0 added privacy-preserving team analytics, workspace-only sharing, and D-Bus control-socket coverage.
  • v0.3.1 added verifiable daily analytics archives and reduced prompt noise without weakening deny decisions.
  • v0.3.2 made egress-rate state outcome-aware. Denied retry storms no longer count as delivered traffic, while repeated blocked-destination spread remains visible to policy.

The CHANGELOG and security policy also document gaps we have not closed. The supervised process tree is the enforcement boundary; delegating authority to a pre-existing process outside that tree is a structural escape class. grith detects known delegation routes, including common control sockets and delegating binaries, but does not claim to replace a VM or container for fully untrusted code.

What is free

The entire security core, forever: the proxy, all 18 filters, the supervisor, the quarantine digest, a local SQLite audit log, the CLI, and the dashboard on localhost:3141. No account, no phone-home, fully offline, bring your own model keys. The free tier is capped at 2 concurrent supervised sessions; the filters themselves have no limits.

The repository code is MPL-2.0. Paid tiers unlock team features - shared policies and configuration, provider-key sync, team analytics, and verifiable daily archives - via signed licenses.

Releases ship with cosign keyless signatures, SLSA provenance, a CycloneDX SBOM, and SHA-256 checksums, and the binary is static musl you can build yourself.

Scope, stated plainly

Linux only today: x86_64 (kernel 4.8+) and aarch64 (kernel 5.3+, shipped in v0.2.4) - so Graviton and Ampere instances, arm64 VPSes, and a Raspberry Pi 4 or 5 on a 64-bit OS all work. macOS (via the Endpoint Security framework) and Windows (via ETW) are v2.0 work. The install script errors out cleanly on unsupported platforms rather than pretending.

Why we think this layer has to exist

We did not start with a product thesis; we started with traces. Running Claude Code and Codex under strace on identical tasks, Claude Code attempted 752 reads of /proc/*/environ in one benchmark run - the methodology and scripts are public. Later, while dogfooding, grith froze a Codex session that had started sweeping the disk for credentials during a routine task.

Not malice. Just capable agents with your whole machine as ambient authority, and nothing underneath them until now.

What we want from you

Break it. The queue thresholds, the profiles, the escape classes we missed - file an issue or reply to anything we post. If you want macOS, there is a pinned issue to register interest so we can prioritise with real numbers.