Skip to content

Ghost v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 18:48
· 40 commits to main since this release
v0.2.0
001d0ba

Ghost v0.2.0

Ghost is a deception-aware security runtime for autonomous AI agents built around deterministic ALLOW, DENY, and SHADOW policies. Version 0.2.0 is a security-hardening release; it does not expand Ghost into a general firewall or attack detector.

Highlights

  • Stronger HTTP/HTTPS destination controls reject raw IPs, local-use names, and prohibited resolved IPv4 ranges, then connect to the validated numeric address.
  • Agent and sidecar containers run non-root with dropped capabilities, no-new-privileges, read-only roots, bounded writable paths, private namespaces, and a positive environment allowlist.
  • Token-scoped containment fencing orders new gateway decisions against observed decoy access, while interrupted-session recovery removes only exactly identified Ghost-owned resources.
  • The Alpine runtime image and GitHub Actions are immutably pinned; Linux release binaries include a verified SHA256 manifest.
  • GhostBench expands from 10 to 15 explicit security-property scenarios. The release gate requires PASS: 15, FAIL: 0, SKIP: 0.

Quick start

Download the Linux binary for your architecture and verify it against SHA256SUMS, or build with Go 1.26 or newer:

go build -o ghost ./cmd/ghost
./ghost init
./ghost run -- echo "hello from ghost"
./ghost inspect latest

Docker Engine and a numeric non-root host UID/GID are required for execution.

Important limitations

Docker, its daemon, the pinned image, the OCI runtime, and the host kernel remain part of Ghost's trusted computing base. Ghost does not prove model intent, causal influence, or credential exfiltration; it does not inspect TLS content or provide arbitrary TCP/UDP egress. Containment cannot revoke traffic that was already authorized and established. GhostBench demonstrates only its named scenarios and is not a universal security proof.

Assets 5
Loading