Overview
PostHog’s Wizard demonstrates both the value and the danger of an agent that can act directly on a developer’s machine. The CLI reads a codebase, selects and installs an SDK, instruments events, and creates dashboards, compressing one or two hours of onboarding into roughly five or six minutes. But the same models, context, tools, and command access that make this experience useful also create what Sarah calls a “malware starter pack.” An internal audit showed that the most serious weaknesses were rarely overtly malicious components; they emerged when individually reasonable features composed into exploitable paths. The greatest concern was PostHog’s own context supply chain: documentation, prompts, examples, or code comments could carry prompt-injection payloads into thousands of installations. PostHog responded with layered controls, including sandboxing, deny-by-default command access, vetted packages, a secrets vault, telemetry, and Warlock, a deterministic YARA-based scanner applied when context is produced and again when it is consumed. An LLM-based triage layer helps suppress false positives but cannot override a deterministic block and fails closed. The central conclusion is that prompts can steer behavior but cannot enforce security; reliable agent security requires narrow capabilities, deterministic gates, compositional threat modeling, and scrutiny of every input entering the model.
Sections
Core Terms
Key concepts used to describe the Wizard and its security architecture.
- Wizard: an agentic CLI that reads a project, selects and installs the appropriate PostHog SDK, instruments events, and creates dashboards.
- Context engine, or Context Mill: PostHog’s in-house system for packaging documentation, handwritten guidance, and working examples into skill bundles that enter the agent’s runtime context.
- Warlock: a standalone deterministic scanner that accepts a string and returns categorized findings with severity and recommended actions, without taking action itself.
- Triage: an LLM-based advisory layer used after deterministic scanning to reduce false-positive noise; it cannot override blocking rules.
- Agent with hands: an agent that can execute commands or otherwise act on a user’s machine rather than only generate text.
Security Architecture and Rule Design
Implementation details behind PostHog’s layered defenses.
- The Wizard’s command layer denies Bash by default and permits a narrow set of operations such as installing vetted packages, building, type checking, and linting.
- Environment files are blocked from the agent, while secrets are routed through a vault so they never enter model context.
- Warlock scans both content entering the model and output written by the agent.
- Context is scanned when a skill is built and released, then scanned again when the Wizard consumes it.
- Warlock rules use YARA, a deterministic pattern engine with a long history in malware research.
- Each rule contains metadata, strings or patterns, a firing condition, and tests covering both matches and non-matches.
- Rule metadata records a plain-English description, severity, category, recommended action, and direction, such as input entering the agent or output being written.
- Telemetry spans the full execution process so PostHog can observe agent behavior and security findings.
Deterministic Enforcement vs. LLM Judgment
The talk distinguishes mechanical security boundaries from probabilistic advisory analysis.
- Deterministic rules act as the bouncer: a match can lock the gate and end the session. The LLM acts only as an adviser that reduces noise after blocking checks have completed.
- YARA provides the same result for the same input, while an LLM may behave differently across runs or conditions.
- A prompt can encourage safe behavior, but a sandbox or deny-by-default policy can actually prevent prohibited behavior.
Primary Threats and Failure Modes
Risks identified while preparing the Wizard for large-scale production use.
- Poisoned documentation, examples, Markdown, or code comments may be packaged into trusted context and delivered as prompt injection.
- Two individually benign components may combine into an exploitable path that is invisible in isolated code review.
- Subagents may attempt to bypass restrictions or fabricate and retrieve secrets while optimizing for task completion.
- Agents may place personally identifiable information such as email addresses and phone numbers into analytics events unless explicitly prohibited.
- An LLM acting as the final allow-or-block authority can make inconsistent security decisions.
- Overly broad patterns generate false positives and encourage operators to disable the scanner.
- As adoption, capabilities, users, and content volume increase, a posture described as 'probably fine' becomes progressively less defensible.