$ cat agent-security/week/2026-10-26.log
the week in review · Oct 26 – Nov 1, 2026
NeMo Relay gains pre-tool-call gate that blocks denied calls
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Guardrails now validates tool-rail models at config load and streams tool calls, while the governance toolkit fixes edge overrides and RAG audit hashes.
feat(relay): NeMo Relay PreToolUse Rust client NVIDIA-NeMo/Guardrails
The Relay plugin now posts each tool's name and arguments to the hooks server's `/v1/hooks/nemo-relay` endpoint before the call runs, and blocks it when Guardrails denies it. If you drive agents through Relay, enforcement moves from post-hoc inspection to the call boundary, so a denied tool never executes.
feat(config): Check model references in tool rails NVIDIA-NeMo/Guardrails
A tool rail manifest that names a model, such as the judge behind `$model=` on `tool safety check`, is now checked against your configured models when the config loads. A misspelled or missing model fails at startup instead of on the rail's first run or when IORails builds the engine.
fix(server): support streaming tool-call requests NVIDIA-NeMo/Guardrails
`tools` with `stream: true` now works on `/v1/chat/completions`: Guardrails generates and validates the full response first, then emits approved text and tool arguments as successive SSE deltas and rejects malformed arguments. Tool rails and HTTP errors still apply to streamed requests, so streaming clients no longer have to drop tool use.
fix(agent-runtime): stop DockerDeployer env from overriding governance settings (#4409) microsoft/agent-governance-toolkit
DockerDeployer.deploy placed the `AGT_*` variables built from your GovernanceConfig ahead of the caller's env entries, and Docker keeps the last `-e` for a name, so a passed env like `AGT_KILL_SWITCH` won. Governance values now win, so deployments that relied on the env override will see the configured setting take effect.
fix(agent-rag-governance): audit a denied collection with the query's hash (#4475) microsoft/agent-governance-toolkit
RAGGovernor wrote the `denied` audit entry with the hash of an empty string, so every blocked collection carried the same `query_hash`. Denied attempts now record the hash of the actual query, which makes the deny log usable for tying back what an agent searched for.
feat(library): add language detector input rail (#2470) NVIDIA-NeMo/Guardrails
A standalone input rail filters inbound content against a language allowlist or blocklist, built on the `fast-langdetect` logic already used by the content safety rail. Operators who need to keep an agent responding in approved languages can configure it directly instead of writing a custom rail.
fix(agent-runtime): include the agent's stderr in DockerDeployer.logs (#4474) microsoft/agent-governance-toolkit
Containers run with `docker run -d` and no TTY, so `docker logs` replays the agent's stderr; `logs` captured the streams separately and returned only stdout, hiding output from agents that log through Python. Both streams now reach you, which matters most exactly when an agent fails in production.
windows: correct the npx command for windows-install anthropics/sandbox-runtime
Alongside: Windows error output printed `npx sandbox-runtime windows-install`, a command the package does not answer to; it now prints `npx @anthropic-ai/sandbox-runtime windows-install` to match the README.
$ ls agent-security/week/ # the briefings behind this review
Keep up with Agent Security in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.