Tencent Zhuque Lab Releases AI-Infra-Guard v4.6.2 with Expanded CVE Coverage and New Agent Safety Benchmarks

Overview and Core Capabilities

Tencent Zhuque Lab has released AI-Infra-Guard (A.I.G), an open-source AI Red Teaming platform designed for self-inspection of AI security risks. The platform integrates ClawScan, Agent Scan, AI infrastructure vulnerability scanning, MCP Server & Agent Skills scanning, and Jailbreak Evaluation into a comprehensive solution. As of the latest metrics, the GitHub repository has garnered 6.7k stars.

Recent Updates in v4.6.2

The v4.6.2 release (dated 2026-09-17) focuses on expanding vulnerability coverage and improving agent safety evaluation:

• Vulnerability Library: Added 155 new CVE rules targeting over 40 AI components, including LangFlow, n8n, PraisonAI, vLLM, llama-cpp, and MLflow.
• Skill-Scan Improvements: Enhanced accuracy by reducing unfounded false positives and implementing stall-free streaming.
• New Agent Benchmarks: Introduced FORGE-Bench and RogueHandoff-20 to assess agent loss-of-control scenarios.

Key Security Features

• AI Infra Vulnerability Scan: Identifies risks in over 100 AI frameworks (e.g., Ollama, ComfyUI, vLLM, n8n, Triton) using a library of 2,000+ CVE rules.
• MCP & Skill Scan: Detects 14 major security risk categories in MCP servers and agent skills, supporting both source code and remote URL analysis.
• Jailbreak Evaluation: Uses curated datasets to assess prompt security risks and compare model resilience.
• LLM API Poisoning Detection: Introduced in v4.6.0, this feature performs multi-probe black-box audits to detect model substitution and backdoor risks.

Research and Benchmarks

The platform incorporates several research-driven benchmarks:

• FORGE-Bench: A deterministic, oracle-based benchmark evaluating how autonomous agents experience loss of control during legitimate tasks across 16 domains and 1,800 trajectories.
• RogueHandoff-20: Tests whether agents adopt unsafe strategies exposed by other agents.
• SkillJack: Demonstrates how poisoned trajectories can inject persistent backdoors into self-evolving agent skill systems.

Deployment and Licensing

• Installation: Requires Docker 20.10+, 4GB RAM, and 10GB disk space. Available via docker-compose or a one-click install script.
• CLI Tools: Includes aig-skill-scan, mcp-scan, and agent-scan for CI/CD integration.
• License: Released under Apache License 2.0, with specific attribution requirements for commercial or internal integrations.