agentshield-sdk 13.2.0 → 13.5.0

package/CHANGELOG.md

@@ -4,6 +4,85 @@ All notable changes to Agent Shield will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [13.5.0] - 2026-04-16
+
+### Detection Hardening + Security Scan Remediation
+
+Tightens existing defenses based on Unit 42 real-world attack research and addresses findings from the Agent Shield security scan.
+
+#### Detector Core — 11 New Patterns (3 categories)
+
+- **Encoding chain detection** (3 patterns) — Detects multi-layer encoding (base64 inside unicode inside URL encoding). Addresses evasion technique that bypasses single-layer decoders.
+- **SVG-based injection** (4 patterns) — Detects hidden prompts in SVG elements, foreignObject, hidden text, and desc tags. Addresses Unit 42 finding of real-world attacks using SVG encapsulation with 24 layered injection attempts.
+- **Structured data injection** (4 patterns) — Detects hidden instructions in JSON metadata fields, XML CDATA sections, YAML/CSV comments, and comment syntax across formats.
+
+#### Cross-Turn Detector — Crescendo Attack Defense
+
+- 5 new escalation signal patterns for crescendo attacks: hypothetical framing, imaginary scenarios, permission boundary softening, false-prior-interaction claims, similarity-based escalation.
+- New crescendo-specific detection: flags conversations that start with hypothetical/theoretical framing and drift toward sensitive/dangerous topics over multiple turns.
+
+#### MemoryGuard — Persistent Memory Poisoning Defense
+
+- `scanSummarization(originalMessages, summary)` detects when context compaction silently injects instructions. Addresses Unit 42 March 2026 research on persistent memory poisoning that survives across sessions.
+
+#### Security Scan Remediation
+
+- **Sidecar server**: API key authentication, request body size limit (1MB default), rate limiting (100 req/min default), CORS hardened from `*` to `same-origin`.
+- **Dashboard WebSocket**: Authentication token support, max connections limit (50 default), startup warning if no auth configured.
+- **GitHub App**: Webhook signature enforced for non-localhost requests, CRITICAL warning if `GITHUB_WEBHOOK_SECRET` not set.
+- **Document scanner**: `maxDocumentSize` limit (10MB default) prevents DoS via oversized documents.
+- **Audit logs**: `sanitizeLogs` option redacts emails, SSNs, API keys, and truncates content fields before writing.
+
+## [13.4.0] - 2026-04-14
+
+### April 2026 Threat Response
+
+Security updates addressing vulnerabilities and attack techniques discovered April 1-14, 2026.
+
+#### Supply Chain Scanner — 16 New CVEs
+
+- **CVE-2026-5058** (CVSS 9.8) — AWS MCP Server command injection RCE, no auth required
+- **CVE-2026-5059** — AWS MCP Server remote code execution
+- **CVE-2026-32211** (CVSS 9.1) — Azure MCP Server has no authentication at all
+- **CVE-2026-21518** — VS Code mcp.json command injection (malicious project files)
+- **CVE-2026-33579** — OpenClaw silent admin takeover (patched April 5)
+- **CVE-2026-24763** — OpenClaw command injection
+- **CVE-2026-26322** — OpenClaw SSRF
+- **CVE-2026-26329** — OpenClaw path traversal / local file read
+- **CVE-2026-30741** — OpenClaw prompt-injection-driven code execution
+- **CVE-2025-59528** (CVSS 10.0) — Flowise RCE via MCP node, actively exploited since April 6, 12,000+ instances exposed
+- **CVE-2025-8943** — Flowise missing authentication
+- **CVE-2025-26319** — Flowise arbitrary file upload
+- **CVE-2026-5322** — mcp-data-vis SQL injection
+- **CVE-2026-6130** — chatbox MCP OS command injection
+- **CVE-2026-5023** — codebase-mcp OS command injection RCE
+
+Updated OpenClaw malicious skill count: 820 → 1,184+ confirmed on ClawHub (3.5x growth).
+Added aws-mcp-server-unpatched and flowise-unpatched to known-bad server blocklist.
+
+#### Detector Core — 15 New Detection Patterns (5 categories)
+
+- **XSS-in-agent-output** (5 patterns) — Catches XSS payloads embedded in AI-generated HTML: script tags, event handlers, javascript: URIs, iframe injection, img onerror. Addresses new attack vector where prompt injections deliver XSS through agent output.
+- **Acrostic/steganographic injection** (2 patterns) — Detects hidden instructions where first characters of consecutive lines spell injection keywords. Addresses 93% evasion success rate reported in April 2026 research.
+- **MCP config injection** (2 patterns) — Detects command injection in mcp.json files. Addresses CVE-2026-21518 VS Code attack vector.
+- **Offensive agent behavior** (3 patterns) — Detects AI agents being used as attack tools: exploitation language, C2 infrastructure, credential theft operations. Addresses April 2026 incident where AI agent compromised 600+ firewalls autonomously.
+- **Cloud IAM overpermission** (3 patterns) — Detects wildcard IAM policies enabling "Agent God Mode". Addresses Palo Alto Unit 42 discovery of AWS AgentCore default role vulnerability.
+
+## [13.3.0] - 2026-04-06
+
+### New SDK Modules
+
+- **RenderDifferentialAnalyzer** -- Detects content that renders differently than it reads. Catches visual deception in HTML (CSS display:none, opacity:0, off-screen, font-size:0), Markdown (link mismatch, hidden spans, comment injection), and LaTeX (\phantom, \textcolor{white}, \renewcommand). Includes VisualHasher for measuring raw-vs-rendered divergence.
+- **SybilDetector** -- Detects coordinated fake agents acting in concert. Behavioral similarity scoring, temporal correlation, content similarity (Jaccard), creation burst detection, and voting collusion analysis. Includes AgentIdentityVerifier with challenge-response and shared-secret detection.
+- **SideChannelMonitor** -- Detects data exfiltration via covert channels. DNS exfiltration (high-entropy subdomains, base64 labels), timing-based encoding, response-size encoding, URL parameter exfil. Includes BeaconDetector (C2 beaconing patterns) and EntropyAnalyzer (Shannon entropy).
+
+### Improvements
+
+- Professional README rewrite: organized by capability instead of version, reduced from 1,348 to ~350 lines
+- All 3 new modules exported via main.js
+- 185 new test assertions (81 render-differential + 49 sybil + 55 side-channel)
+- Total: 3,400+ test assertions across 22 suites
+
 ## [13.2.0] - 2026-04-06
 
 ### DeepMind AI Agent Traps -- First-Principles Defense