I built HandoffProbe: open-source security testing for AI agent handoffs
I’ve been thinking a lot about a security gap in AI systems:
An agent can look secure on its own.
A tool can look secure on its own.
A protocol can look secure on its own.
But when control passes from one component to another, important guarantees can quietly break.
That’s the problem I built HandoffProbe around.
HandoffProbe is a local-first open-source CLI for adversarial security testing of AI agent handoffs.
The goal is to make boundary failures reproducible and testable instead of hand-wavy.
The kinds of questions I care about are things like:
does a handoff widen authority or permissions?
does identity / tenant context survive the transition?
can untrusted tool output get reinterpreted as instructions downstream?
are approvals, constraints and audit lineage preserved across the handoff?
can replay or malformed payloads trigger unexpected behavior?
The current version is early, but public and usable.
I wanted to start with a deterministic local tool rather than a hosted security layer, because I think developers need something they can run directly against their own agent workflows and CI.
Right now I’m especially interested in feedback on three things:
Which handoff failure mode worries you most in real agent systems?
Is local-first CLI the right starting point, or would you expect this problem to be solved somewhere else in the stack?
If you were evaluating a tool like this, what would make it immediately useful to you?
If anyone here is building agentic systems, security tooling, or protocol infrastructure, I’d love to hear how you think about this problem.
