Skip to content

Back to the catalog

Trail of Bits AI-Native Journey
blog.trailofbits.comarticle

Trail of Bits AI-Native Journey

Trail of Bits describes the internal "operating system" it built to make itself AI-native: a standardized Claude Code toolchain, an AI usage-policy handbook, a capability maturity matrix, recurring hackathons run in "bypass permissions" autonomous-agent mode, and six open-sourced repos (skills, skills-curated marketplace, claude-code-config, claude-code-devcontainer, dropkit macOS sandbox, slither-mcp) that package 94 plugins/201 skills/84 agents. Security-relevant specifics include treating agent autonomy as requiring sandboxing and hardened defaults by default, a curated skills marketplace to avoid backdoored third-party AI plugins, prompt injection to client codebases flagged as an unsolved "existential" risk (with pointers to kernel-level agent shells like nono and agentsh), and claims that AI now surfaces ~20% of bugs in client audits (15→200 bugs/week on some engagements). It's largely an org-process/adoption piece rather than a technical deep-dive, but the linked tooling and the agent-security framing make it useful for teams rolling out autonomous coding agents safely.

TL;DR Trail of Bits' account of building an org-wide system (policy, sandboxing, curated skills marketplace, MCP tooling) to safely run autonomous AI agents in security audits, with six open-sourced repos.
Open original ↗
Also seen from another angle🧠 AI →
Document

What it is

Trail of Bits' talk-adapted playbook for going "AI-native." The existing summary captures the tooling scale, the six repos, and the agent-security framing. What it omits are the concrete governance rules and the operational specifics an engineer would actually copy — those are below.

The concrete policy rules (not in the summary)

The AI Handbook's usage policy makes specific tool-level calls:

  • Cursor is banned on client code — with one exception: blockchain engagements, where auditors use Claude Code or Continue.dev instead.
  • Meeting recorders are disallowed for any client meeting conducted under legal privilege.
  • Sensitive clients = no web access for the agent. This is stated as a deliberately "blunt instrument" pending better tooling.

The stated purpose: when a client asks what's running on their codebase, every consultant gives the same answer.

Hardening mechanics

  • Secure defaults pushed via MDM (Jamf), including mandatory package-manager cooldown policies — a supply-chain control against freshly-published malicious package versions.
  • Sandboxing offered as three interchangeable "safe lanes": devcontainer, native macOS sandbox, and Dropkit. The design principle is that everyone has a sandbox, not the same one.

Open problems they explicitly can't solve yet

  • Prompt injection on client code is called "existential" — the agent inherently can access the data it works on. Long-term direction: kernel-level policy-enforcing shells nono and agentsh.
  • Private inference: open models still lag closed ones on coding benchmarks; they're evaluating on-prem servers for 230B+ models at full precision, with the insight that speed drives adoption more than capability. Interim option named: Tinfoil.sh (confidential computing on NVIDIA GPUs, cryptographically verifiable).
  • Policy enforcement: settings push out via MDM but no signal comes back. Proposed architecture is a master MCP server between agents and internal resources enforcing policy server-side — "we're not there yet."

Numbers worth citing

Beyond the summary's 20%-of-bugs and 15→200/week figures: 94 plugins / 201 skills / 84 agents / 29 commands / 125 scripts / 414+ reference files, and a business claim of $8M revenue per sales rep vs. a $2–4M consulting benchmark using the same skills repos.

Caveats

Delivery numbers are self-reported and scoped: the 200 bugs/week applies only to "certain clients where the codebase and scope allow it." Every AI-surfaced finding is human-validated before it reaches a report. This remains an org-process piece — the value here is the reproducible governance recipe, not any exploit or detection.

Technologies named here

Techniques named here

Related in AI Security