The security gate that reported green for months
From 20 May, a security audit gate in our nightly pipeline of AI agents inspected the wrong branch. It reported green every night for months, because a broken control still reports success. We fixed it by binding every agent approval to a hash of the exact files the agent read, and checking that hash again before anything ships.
- Published
- Reading time
- 5 min
What happened
We run a nightly pipeline of more than 20 autonomous agents. They research, design, audit, build and test production code for our own products, including ReplyOS.
One of those agents is a security audit gate. Its job is to inspect a change and approve it or refuse it. From 20 May it was inspecting the wrong branch. Because it was not looking at the change in front of it, it could not fail. It approved every night, for months.
Nothing alerted us. The gate ran on time, returned a result and logged a pass. By every measure we were watching, the control was working. It was working on the wrong thing.
Why nobody noticed
Monitoring tells you whether a control ran. It rarely tells you whether the control looked at what it was supposed to look at. A gate that cannot see the change in front of it will never fail, and a gate that never fails looks exactly like a healthy one.
This is the uncomfortable part for anyone putting AI agents into real work. An agent's approval is an assertion. Unless something ties that assertion to the thing that was inspected, you are trusting the agent's word that it looked.
The fix
We changed what an approval is. When an agent approves, its verdict is now bound to a SHA-256 hash of the exact files it read. Before anything ships, the gate hashes those files again. If anything has changed since the approval, it refuses.
When we pointed the new check at the 23 agent pull requests that were open at the time, it refused all 23. These are figures from our own internal engineering record, not client results.
What we did with it
We released the check as Slipmark, an open-source GitHub Action under the Apache-2.0 licence. It runs in our own ReplyOS pipeline, where we also use it to lock behaviours we never want to change silently, such as tenant isolation and enquiry capture.
Slipmark does not prove that an agent behaves correctly. It detects when what was approved is no longer what ships. That is a narrow promise, and we think narrow promises you can check are worth more than broad ones you cannot.
What this means if you use AI in your business
You do not need a pipeline of 20 agents for this lesson to apply. Any AI step that approves, sorts or sends something should leave a record of what it looked at, and someone should be able to check that record against what actually happened.
When we build a workflow for a client, that is the standard we hold it to: every action recorded, approval steps where a mistake would matter, and tests that deliberately include the failures.