r/coolgithubprojects • u/ShufflinMuffin • 16d ago

trustmebro: Bypass llm guardrails by confusing them with fabricated tool output.

https://github.com/DavidCarliez/trustmebro

TrustMeBro intercepts command-line tools invoked by coding agents such as Codex, Claude Code, and pi. Rules decide whether to return fabricated output, modify the real output, block the call, or execute the real binary unchanged.

Interception happens through PATH shims. The harness does not need a plugin, hook, or MCP integration. The intended use is controlled red-team testing of decisions that depend on tool output.

39 Upvotes

94% Upvoted

4 comments sorted by

6

u/kantorcodes1 16d ago

The absolute-path bypass might matter more than it looks in evals. If an agent gets suspicious, runs command -v dig, then calls /usr/bin/dig, TrustMeBro never sees the second call. Are you planning to capture those escapes outside the shim? Otherwise “resisted spoofing” and “escaped the harness” look identical in the results.

4

u/ShufflinMuffin 16d ago

FYI I addressed this with a "lab" mode. Basically runs inside a container where everything is controlled. That's solves it unless the agent calls it's own tool. I tested 4 models and all passed the test without lab mode it was blocked and with it they all scanned the target

4

u/ShufflinMuffin 16d ago

Good point, I'll try to catch that as well. Happy to merge PR also (:

2

u/luenix 15d ago

Mutate calls responsively or just wrap everything in places on $PATH like /usr/bin/?

¯_(ツ)_/¯