15:I[981,["658","static/chunks/658-a698693f56d0116a.js","183","static/chunks/183-6beeeb801c274aaa.js","474","static/chunks/app/%5Btype%5D/layout-631c4730b83c8223.js"],"Posts"] 16:T61d,Hello HN,

We built an open-source, sidecarless service mesh to govern autonomous AI agents on Kubernetes.

The Problem: Standard meshes (Istio/Cilium) operate at L4/L7. They see connections, but they don't see intent. If an autonomous agent gets stuck in a loop and burns $1,000 in OpenAI tokens, or decides to run DROP TABLE to "optimize storage," a standard mesh sees a valid HTTP 200 OK.

The Solution: SemaMesh uses eBPF (sock_ops) to transparently intercept outbound traffic from AI pods and route it through a local semantic proxy (Go) that enforces "Layer 8" policies.

Features: . eBPF-based: No sidecar injection required. . Semantic Blocking: Parses JSON prompts to block high-risk intent (e.g., "delete database") before it leaves the node. . Stateful Pause: Integrates with CRIU to freeze/checkpoint a rogue agent's process state for forensics instead of just killing the pod. . Token Quotas: Rate limit by $$ cost, not just requests per second.

Tech Stack: . Datapath: C (eBPF) . Proxy/Control Plane: Go . Orchestration: Kubernetes (DaemonSet/Operator)

We just released v0.4.0 with a "Smoke Test" script that spins up a local Kind cluster and simulates a "Rogue Agent" attack so you can see the blocking logic in action.

Repo: https://github.com/semamesh/SemaMesh

Would love feedback on the eBPF interception logic or the CRIU integration approach.17:T781,Secrets management with Agents feels absent today. The agent needs API keys to call external services, but the usual patterns feel broken in this context. You see this clearly when writing Agent Skills.

Environment variables: The agent has shell access. It can run `env` or `echo $API_KEY`

The Absurdity of the Tech Bro – Mountainhead

I Built Gungi from Hunter X Hunter – Play It Now

Why "Plot" Isn't a Four-Letter Word

GNU FTP Server

Complaining about Windows 11 hasn't stopped it from hitting 1B users

U.S. Judge in Mangione Case Rules Prosecutors Cannot Seek Death Penalty

Pi Monorepo: Tools for building AI agents and managing LLM deployments

Ksnip the cross-platform screenshot and annotation tool

Hey, ChatGPT: Where Should I Go to College?

Disrupting the IPIDEA residential proxy network

Synchronization

Shopify connects any merchant to every AI conversation

Herdctl: Orchestration Layer for Claude Code

The reason Amazon cut 30k people and what the balance sheet shows

Encrypt It Already – not enough companies use end-to-end encryption

Nvidia Releases a Geforce Now App for Linux Systems

Decoding the Immich Stack: From Front End to Microservices

Full AI Suite for LispE: Llama.cpp, Tiktoken, MLX and PyTorch

Building Breakwater with AI

Exposure to microplastics from food: Comparative analysis of food types

Scientists recreate historical scents – Knowable Magazine

Show HN: SemaMesh: eBPF-based firewall for AI Agents(blocks destructive prompts)

Superfluids supposed to flow indefinitely; but observed a Supersolid

Show HN: I'm giving away my MicroSaaS

Ask HN: How are you managing secrets with AI agents?

What if LLM pipelines were just algebra? ((R and A) → W)² ÷ C → E

AI Code Review Without the Comment Spam

Venus Might Harbor Subsurface Lava Tunnels

Rover wheel tribocharging in lunar shadowed regions

MIDI Survivor

Show HN: Enshrouded (Game) Crafting Recipes