TrustMeBro fabricates evidence shown to an AI

TrustMeBro is a Go-based interception tool designed to manipulate command-line tool outputs invoked by AI coding agents such as Codex, Claude Code, and pi. It uses PATH shims to intercept commands and applies user-defined rules to either spoof outputs, rewrite real command outputs, block calls, or pass them through unchanged. The tool can generate realistic DNS query responses and modify outputs to bypass AI guardrails, enabling red-team testing of AI behavior in response to fabricated evidence. It supports configuration via YAML rules and logs all decisions in a JSONL audit log. Lab mode uses Bubblewrap to create an interception namespace that shadows PATH lookups and absolute command paths, preventing agents from bypassing interception by calling absolute binaries. The tool is not a security sandbox and reuses the host environment, filesystem, and network. It is primarily intended for controlled local testing and research.

The tool enables the fabrication of command-line tool outputs shown to AI coding agents, potentially causing these agents to make decisions based on false or manipulated data. This can lead to AI models performing unauthorized actions, such as scanning domains they do not own, by bypassing guardrails that rely on command output verification. The impact is limited to environments where TrustMeBro is installed and configured, as it requires local interception of command invocations. There is no indication of remote exploitation or widespread active attacks. The tool is intended for red-team testing rather than malicious use, but it demonstrates a novel method to confuse AI models by fabricating evidence.

This tool is intended for controlled local testing and red-team scenarios. No official patches or vendor advisories apply as it is an open-source tool designed for interception and output fabrication. Mitigation involves ensuring that AI coding agents run in environments where command outputs cannot be intercepted or manipulated by untrusted tools like TrustMeBro. Organizations should restrict installation of such interception tools on critical systems and monitor for unauthorized PATH modifications or shim installations. Since this is a testing tool, no urgent remediation is required unless it is found running in unauthorized environments.