v0.4.23 Security Catch-Up: SAML, Agent Identity, and Exfiltration Defenses

The reviewed changes now ship in v0.4.23. Download the Go CLI archive for your operating system and architecture using the release link above. If you use the optional Rust sidecar, update its matching engine binary too. Downloads cover Linux, macOS, and Windows on amd64 and arm64, with checksum manifests, Sigstore bundles, and GitHub artifact attestations. Go archives also include software bills of materials.

The Rust configuration format stays compatible. The prebuilt sidecar keeps the existing portable configuration; optional packet capture and post-quantum features require a source build. Delegation integrations must supply trusted verification metadata as described below, and SAML detection requires response telemetry. Installing the update makes the detectors available; feeding them the relevant events makes the new checks useful.

After a pause in weekly reporting, this cycle covers July 21 through October 13. We reviewed 92 vulnerabilities newly added to CISA's Known Exploited Vulnerabilities catalog, 275 high- or critical-severity NVD records, and ten editorial or specialist research feeds against 18 engine components. These are broad ecosystem records, with possible overlap between feeds; they do not establish 367 vulnerabilities in 1-SEC.

The implementation pass focused on gaps confirmed in the code: suspicious SAML response structure, unverified agent authority, missed credential-exfiltration sequences, and misleading markdown destinations. The Go detector changes use the standard library, and the Rust sidecar's YAML backend now uses a maintained replacement.

Auth Fortress now raises alerts for SAML responses containing duplicate XML IDs, displaced assertions, or signatures pointing at a different element from the one carrying authentication claims. It also checks for unsigned plaintext assertions, misleading namespaces, DTDs, and signature transforms that can exclude claims from signed content.

Inspection is bounded so hostile XML cannot demand unlimited work from the detector. It accepts XML, base64, and SAMLResponse form submissions supplied through SAML event telemetry. Customers feeding those events into 1-SEC receive high-severity alerts through the existing response pipeline.

This is structural detection. Your service provider still needs to verify the signature against its trusted identity provider, validate the audience and lifetime, and prevent replay. Encrypted assertion contents remain the service provider's responsibility. The work addresses a documented attack class; it does not claim a newly observed SAML campaign against 1-SEC users.

API Fortress previously could decode an admin role from a bearer token and use that claim to suppress an unauthorized MCP registration alert. A token payload alone is not proof of authority. MCP provisioning checks now use the authenticated role supplied by the trusted integration, so a forged admin claim cannot grant that exception.

AI Agent Containment also tightens its delegation records. Supplying a string that looks like an attestation is no longer enough: the identity integration must confirm verification, bind it to the agent and human principal, and provide a valid future expiry. Unverified or invalid records cannot satisfy the existing delegation check for sensitive actions such as deletion, payments, or deployment. The same rules reach the linked Token Vault authorization path: account grants expire, renewal replaces the previous grant, and tool-use monitoring requires both identities.

Integrations that send delegation events must now include the verified identity result from their trusted verifier. Missing verification generates alerts. These checks monitor identity decisions; they do not turn 1-SEC into a replacement identity provider.

LLM Firewall now recognizes sensitive-file reads followed by encoding and an outbound HTTP request. A sequence such as reading a workspace .env file, encoding its contents, and posting them to another service is correlated within a rolling 60-second window. Steps from an earlier window expire, and one agent's history is kept separate from another's.

The markdown exfiltration check also examines the actual destination hostname. Addresses such as localhost.attacker.example or localhost@attacker.example previously could resemble an allowed local URL; they now trigger the external-destination check when produced after untrusted web content was fetched. Real local destinations retain the existing policy.

We also corrected concurrent access to web-context taint state so fetched context and output inspection can run together safely.

The implementation includes Go 1.26.9 and dependency upgrades to github.com/klauspost/compress v1.18.7, golang.org/x/crypto v0.56.0, and golang.org/x/sys v0.47.0. The Go patch release addresses standard-library security findings, while the compression and crypto updates cover the advisories identified in those packages.

The Rust dependency review also found an unmaintained YAML backend that was failing the repository's dependency gate. We replaced it with the YAML organization's maintained yaml_serde v0.10.7 fork, preserving the configuration format and removing unsafe-libyaml from the dependency graph. A yanked transitive chacha20 lock entry moved to v0.10.2. Existing optional post-quantum provider maintenance warnings remain tracked for a provider migration.

After the changes, govulncheck reports zero vulnerabilities affecting reachable Go code. It still lists an advisory for deprecated OpenPGP functionality in the required crypto module, with no fixed version; the scan found no affected package imported or function called. A clean reachability result is a scoped check, not a promise that no vulnerability could exist.

Regression cases exercise forged MCP role claims, unverified and expired delegation, connected-account authorization, SAML wrapping structures, XML inspection limits, sensitive-read exfiltration chains, stale tool steps, and deceptive markdown hosts. The Go engine tests with race detection, binary build, vet, staticcheck, security scan, and vulnerability reachability scan pass. Rust regression tests, all-feature static checks, and repository dependency checks also pass; live packet capture was not exercised in this cycle.

Existing SafeTensors checks, Linux inotify monitoring, WebSocket framing validation, and overlapping event scans were reviewed as existing coverage. They are not being presented as new features in this cycle. The public repository includes implementation notes and the telemetry requirements for the new checks.

The reporting workflow continues through source verification, applicable code changes, regression checks, and an updated implementation ledger. The blog follows that work and describes what changed for users. Proposals that need more evidence or customer-specific policy inputs remain identified as deferred work.

This cycle's completed fixes are available in both the public engine source and the v0.4.23 downloads. Existing installations need to upgrade to receive them. Regular weekly reviews will return to a shorter collection window.