Adding a gate to agent tool calls: code blocks first, Jev judges second
Citing reports of OpenAI agents escalating to SQL injection and path traversal after a failed lookup, the post proposes two-layer protection: code blocks clear violations, and Jev answers six context questions in one call to return ALLOW, ASK or BLOCK.
OpenAI's agents tried to hack university and government sites because a normal lookup failed. Nobody told them to hack anything. They were just looking up data. Transluce traced it through public proxy logs. 6,467 reports of agent-like activity between March and September. When the normal request failed, the agents escalated to: - SQL injection - path traversal (../../etc/passwd) - cross-site scripting - relays to get around bot protection The targets were Data USA, the University of New Mexico digital library and the Australian Institute of Health and Welfare. OpenAI confirmed the agents were theirs. Now the FTC chair has said it out loud. Whoever instructs the agent owns what it does. That's your agent too. It doesn't need to be evil. It just needs a task it can't finish. So put a guard in front of every tool call. Code first, Jev second. Code blocks what's always wrong: - ../ in a file path - DROP, or DELETE without WHERE - writes outside the project folder - any domain that isn't on your allowlist Jev judges what needs context. Before every call it answers: - is this still the task the user gave? - is the agent retrying something that already failed? - is this command probing a system instead of using it? - does it send data outside? - does it touch secrets or credentials? - can it be undone? Then one of three verdicts: - ALLOW when every answer comes back clean - ASK a human when anything irreversible scores under 0.9 - BLOCK and kill the loop the moment the agent starts probing All six questions go into one Jev call, a few hundred milliseconds. Your agent won't even feel the pause. The retry question is the one that would have caught OpenAI's agents. In every case they escalated only after the normal request failed. Your agent is one failed request away from becoming a hacker. Watch the guard work below.