Skip to content
LIVE

This AI-agent host fights back.

This is a real public Linux box running InnerWarden around an agent-capable environment. The feed below shows the pressure that hits the machine your AI worker depends on: network probes, brute force, suspicious commands, and hostile sources. InnerWarden decides locally before the host around the agent becomes someone else's machine.

130.162.171.105protected agent host · public IP · no WAF · no human in the loop
0
Attackers stopped (7d)
0
Decisions today
0
Humans paged
Put this around your agent host in under a minute
curl -fsSL https://www.innerwarden.com/install | sudo bash
Source on GitHub·Apache-2.0·Linux · Rust · eBPF
Attack origins
Agent host
Active (24h)
Quiet (7d)
Inner Warden Bot
Agent host protection · 82 detectors · 45 eBPF hooks
online
Quiet on the wire. The agent host is awake; nothing has tripped a detector in this window.
Hit the host. Watch the guard decide.
Pick an attack. Run it. Within 5 seconds you should see your IP land on the map, get a verdict in the feed, and (if you push hard enough) end up in AbuseIPDB.
Open a Terminal on your computer (Linux/macOS: Ctrl+Alt+T or just Terminal. Windows: search PowerShell). Paste a script, press Enter, scroll up and watch InnerWarden decide what reaches the protected agent host.
1. SSH brute-force run
Ten common usernames in a tight loop, each attempting publickey auth with an empty key (-i /dev/null). Triggers ssh_bruteforce + sliding-window detector via the "Failed publickey" line that sshd logs on every hardened server. Expect: block decision within ~2 seconds, IP added to the kernel-side blocklist via XDP.
for user in admin root test deploy postgres mysql nginx www backup oracle; do
  ssh -i /dev/null -o ConnectTimeout=2 -o StrictHostKeyChecking=no -o PreferredAuthentications=publickey $user@130.162.171.105 2>/dev/null
done
2. Credential stuffing
Twenty distinct usernames from one IP. Different shape than brute-force; trips credential_stuffing + the distinct-user-per-IP detector. Expect: a different verdict line and threat-DNA fingerprint.
for i in $(seq 1 20); do
  ssh -i /dev/null -o ConnectTimeout=1 -o PreferredAuthentications=publickey user$i@130.162.171.105 2>/dev/null
done
3. Single probe (just to see yourself)
One handshake, one rejected auth. The lowest-impact way to put your IP on the map and prove the pipeline works end-to-end.
ssh -i /dev/null -o ConnectTimeout=2 -o PreferredAuthentications=publickey test@130.162.171.105
These commands are safe to run from your machine. They only generate failed SSH auth attempts; nothing gets installed, nothing gets modified locally. Works on Linux, macOS, and Windows (PowerShell).

Live protected agent host. One real Linux box on a public IP, defended only by InnerWarden. This is the infrastructure layer an AI agent would rely on: filesystem, network, packages, credentials, and tool calls. No WAF, no managed firewall, no human watching.

Go ahead. Try it. The same host-level guardrails that catch SSH brute-force, credential stuffing, port scanning, reverse shells, fileless payloads, ransomware, DNS tunneling, and privilege escalation also give an agent a safer machine to work from. Your IP gets fingerprinted, correlated against recent activity, and may be temporarily blocked while you test.

Put this around your AI agent.

One command. eBPF sensor + AI agent + local dashboard. Starts in dry-run; the host stays observable while you connect the agent and decide what should be blocked. No telemetry, no cloud control plane, no API key required.

curl -fsSL https://www.innerwarden.com/install | sudo bash
Star on GitHubHow agent protection works
Apache-2.0·Linux · Rust·Self-hosted·No telemetry