[Open Source] OshoosiClaw (v1.2.0): A decentralized, autonomous EDR and AI agent containment engine in Rust. Looking for devs and pentesters to help break it.
Description
OshoosiClaw v1.2.0 is an open source decentralized, autonomous Endpoint Detection and Response (EDR) and AI agent containment engine written in Rust for Linux and Windows. It operates locally with kernel and hardware boundary enforcement, aiming to defend against advanced attack techniques such as kernel callback blinding and AI agent breakouts. The project is actively seeking developers and penetration testers to evaluate its security by attempting various attack methods and to contribute improvements. No known exploits or vulnerabilities have been reported at this time.
Reddit Discussion
Hey everyone, I am the creator of OshoosiClaw (OpenỌ̀ṣọ́ọ̀sì), an open source autonomous Endpoint Detection and Response agent built in Rust for Linux and Windows.
Traditional user mode sensors often rely on cloud telemetry and remain vulnerable to kernel callback blinding, BYOVD handle stripping, and modern AI agent breakouts. I built OshoosiClaw to operate as a local first, decentralized immune system that enforces security directly at the kernel and hardware boundaries while keeping its working set under 250 MB.
On the defense side, it pairs a Windows Ring 0 Minifilter and ELAM driver with Linux BPF_PROG_TYPE_LSM hooks and a sub 20 microsecond Cgroup v2 freezer quarantine. It includes an in memory 101 table SQL telemetry engine (siquery), an autonomous reverse engineering subsystem using Magika and YARA X synthesis, a 14 engine detection pipeline, and multi ring containment mapped to MITRE ATT&CK and ATLAS for local AI agents. Nodes share intelligence over a libp2p GossipSub mesh secured with hybrid post quantum cryptography (ML KEM 768 and ML DSA 65), BLAKE3 Merkle audit chains, and differential privacy.
I am looking for both Rust developers and offensive security folks or pentesters to put this through its paces:
For Pentesters and Red Teamers: I want you to try and break it. Throw your custom loaders, process hollowing techniques, unhooking PoCs, BYOVD payloads, and prompt injection or agent breakout chains at it. You can also run the built in 16 vector adversarial gauntlet (osoosi redteam --suite all) or test against the active thread tarpit and synthetic anti blinding canaries to see where the detection or containment logic folds.
For Rust and Kernel Developers: If you enjoy working on eBPF, Windows kernel drivers, low latency systems programming, P2P networking, or local ML inference, I would love your eyes on the architecture, code quality, and performance bottlenecks.
Pre built v1.2.0 packages (.msi, .deb, .rpm, and hardened Docker images) and full source are live on GitHub:https://github.com/oyesanyf/OshoosiClaw
If you find a bypass, trigger a false positive, or want to contribute a crate improvement, please open an issue or PR, or drop a comment below. Looking forward to your feedback.
oyesanyf
Links cited in this discussion
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OshoosiClaw is an autonomous EDR agent designed to provide local, decentralized security enforcement at kernel and hardware levels on Linux and Windows platforms. It integrates Windows Ring 0 minifilter and ELAM drivers, Linux BPF LSM hooks, and Cgroup v2 freezer quarantine for containment. The system includes a telemetry engine, reverse engineering subsystem, multi-engine detection pipeline, and AI-driven containment mapped to MITRE ATT&CK and ATLAS frameworks. Nodes communicate intelligence over a libp2p GossipSub mesh secured with hybrid post-quantum cryptography. The project is open source and invites security researchers and developers to test and improve its defenses, but no specific vulnerabilities or exploits have been disclosed.
Potential Impact
No confirmed vulnerabilities or exploits are currently known for OshoosiClaw v1.2.0. The impact potential relates to its role as an EDR and containment engine that, if compromised, could affect endpoint security. However, since this is an invitation for testing and development rather than a report of a vulnerability, no direct impact from exploitation is documented.
Defensive Guidance
As this is an open source security tool seeking testing and development contributions, no specific mitigation is required. Users and testers are encouraged to participate in the security evaluation by attempting to bypass or break the system and reporting findings via the project's GitHub repository. Monitor the repository for updates, patches, or advisories resulting from community testing.
Technical Details
- Source Type
- Subreddit
- ExploitDev+pwned+hacking
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":30,"reasons":["external_link","newsworthy_keywords:rce","non_newsworthy_keywords:vs","established_author"],"isNewsworthy":true,"foundNewsworthy":["rce"],"foundNonNewsworthy":["vs"]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6ada2c3b4d27ba8daa61ab48
Added to database: 10/22/2026, 15:31:07 UTC
Last enriched: 10/22/2026, 15:31:12 UTC
Last updated: 10/22/2026, 16:15:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.