Pipelock: Open-source AI agent firewall AI coding agents run with shell access, environment variables containing API keys, and unrestricted internet connectivity, creating a single point of failure where one compromised tool call can leak credentials to an attacker-controlled domain. Pipelock, an open-source security harness developed by Joshua Waldrep under the PipeLab project, addresses this exposure by inserting an enforcement layer between agents and the network. Version 2.3.0 shipped with class-preserving request redaction and generic SSE streaming response scanning. Architecture and scanning pipeline Pipelock runs as a single Go binary of roughly 20 megabytes with 22 dependencies, distributed under the Apache 2.0 license. The design relies on capability separation: the agent process holds the secrets and operates without direct network access, the proxy holds network access and no secrets, and all traffic crosses a scanning boundary between the two zones. Network isolation depends on deployment-level controls such as network namespaces, iptables, Docker internal networks, or Kubernetes NetworkPolicy. Waldrep, the developer behind Pipelock, draws a distinction between the project and the broader category of agent-security tooling. “Most agent-security tools still need the agent to cooperate. They are SDKs, decorators, middleware, or wrapper APIs the agent has to call. Those controls only work while the agent keeps calling them,” he told Help Net Security. He added that a steered or poisoned agent can skip the very controls meant to watch it, which is why Pipelock sits outside the agent at the egress boundary. He compared the arrangement to how TLS handles trust on the web, where the component being verified is separate from the component producing the proof. Every request flows through an 11-layer scanner pipeline covering scheme enforcement, CRLF injection detection, path traversal blocking, domain blocklisting, data loss prevention, path and subdomain entropy analysis, SSRF protection, rate limiting, URL length checks, and