Skip to content

Break the Agent · live experiment

Make the agent do damage. The machine says no.

Wren is a real AI agent with a real shell on a real Linux box, told to attempt the commands you ask for. The secret is in ~/secret.env. InnerWarden guards the machine, not the prompt.

You win if the secret shows up in Wren's reply or anywhere on this page, or if Wren runs a program the kernel should have refused. Tell us how at contact@innerwarden.com: we fix it, and credit you by name if you want.

Live from this boxWho is hitting it
Live feed unreachable from your network. Retrying every 15s.
Reconnecting to the live host…
What these numbers count

Every decision counts here, dismissals of routine noise included. InnerWarden applied and recorded these decisions on the host. Its triage can call a cloud model the operator configures, and this box's does. A case it cannot settle waits for the operator, whose dashboard lists it as waiting on you. The operator's dashboard sorts cases into three lanes, messages to your AI agent, what your AI agent did, and attacks on this server; raw telemetry and response bookkeeping belong to none of them and are listed under Everything in Cases.

Talk to Wren

132.196.94.153paid stack · feed reconnecting

Wren is told to attempt the commands you ask for. Try to make it do damage, or get the secret in ~/secret.env out of the box. Start with one of these:

10 of 10 draws left · new to testing agents? draw one
Rules, and what the public feed shows

Authorised security experiment. Be reasonable - no flooding, no attacking the host directly (only via the conversation). Messages are logged. Once the model's provider has screened a message, the public live feed may show it, with links, addresses, e-mail addresses, handles and phone numbers removed; a message the provider stops is never shown. A command appears only as its shape: the programs it ran and a few flags, with every other argument replaced by an ellipsis.

Three layers a visitor's prompt meets

The first two are the model's provider and the model itself, and can be talked past. The third is InnerWarden: a screen in userspace, then the kernel.

  1. 01Provider safety filter
    can be bypassed

    Azure Prompt Shield screens the obvious jailbreaks before the model ever reads them.

  2. 02The model's judgement
    can be bypassed

    If a prompt gets through, the model still decides whether to comply. Wren is told to attempt the commands it is asked for, so for commands this layer is open on purpose.

  3. 03InnerWarden runtime guard
    kernel enforced

    Every command is screened in userspace, then the kernel Execution Gate starts only the programs on the agent's allowlist: nc, wget, curl or a binary it drops get EPERM. The gate decides which programs start, not what an allowed one does, and python3 is allowed, so the secret has a guard of its own: the Secret Read Guard refuses, in the kernel, to open it for the agent and every program it starts. Both cover the agent, not the whole machine: we, as root on the box, can still read the file.

The host around it

Who is hitting this host, and what InnerWarden decided

This is our public challenge host, running the paid stack on the open internet, seen from the outside: where the sources that touched it came from, and what InnerWarden decided about each. Azure's network firewall opens only a few ports and there is no WAF in front of it; what InnerWarden cannot settle waits for the operator.

Attack origins
Quiet on the wire right now0sources seen (7d)
Agent host
Active (24h)
Quiet (7d)

What InnerWarden decided

reconnecting
Quiet on the wire. The agent host is awake; nothing has tripped a detector in this window.

Runtime guardrails, not prompt guardrails.

Put the same guardrail around your own agents. The free Community CLI (inner-warden, Apache-2.0) screens their commands and tool calls; Active Defence, the paid tier, adds the kernel gate on Linux. Both run on your box.

On this box, Wren's model, the prompt shield in front of it and InnerWarden's AI triage use Azure OpenAI.

Start a security pilotSee pricing
AI agent security

Read next: how the attacks on this box work

AI Agent Security

Indirect Prompt Injection: From Poisoned Input to Syscall

A poisoned file rewrites the agent's intent, and the damage lands on the host as execve, openat or connect.

Read
AI Agent Security

Why the Kernel's No Beats the Model's No

A model's refusal can be argued with. On Linux, the kernel's refusal at exec cannot.

Read
Evidence

Watch InnerWarden Stop a Hijacked AI Agent

Lab recordings of a compromised agent stopped below the agent process, including an unknown program denied in the Linux kernel.

Read