Observed arrival · 2026-10-13
LatchLens: an attack lab for agent permissions
An interactive prototype that tests Latch policy JSON against adversarial requests and produces traces and draft evidence.
- For
- Builders testing Latch policies for autonomous-agent permissions
- Worth noticing
- Its 14-case deck covers destructive verbs, endpoint confusion, token theft, cost bursts, PII egress, and signer-wildcard abuse.
Field notes
The interface accepts a Latch pipeline as JSON and keeps local analysis in the browser, with a warning not to include secrets. Its attack deck names cases such as endpoint confusion, cost bursts, PII egress, and signer-wildcard abuse; each scenario is meant to show the ordered first-deny trace. A separate live comparison is described as optional and limited to six safe hypothetical requests. The report can be prepared locally, but the page says Rialo anchoring is not yet available without attestor deployment.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue