Sandbox demo · no account · fake secret

Playground

Watch an agent try to leak a secret.
Watch the firewall stop it.

Pipelock sits between AI agents and the internet and blocks secret leaks, unsafe tool traffic, and prompt-injection responses. Step through one real run below, then verify the result yourself, offline.

The firewall guards what leaves, not what the agent can read.

The agent can read the planted secret. That is allowed, and it is the whole point: it still cannot move it out past Pipelock. Every mediated attempt is signed before the destination ever sees it.

planted canary demo secret allowed read safe.target.test off-limits collector exfil.target.test
Start the run

The secret here is fake and planted. This is a sandbox, do not enter real secrets.

Live demo

One agent. One secret. Every move signed.

Read left to right. Manipulation enters at Chat, the agent acts, Pipelock decides, and the proof is yours to re-check.

Read the challenge rules: what counts as a bypass, what does not, and how to verify the signed result yourself.

01

Chat

Untrusted input. The agent believes it.

02

Agent

What it tried. Unsigned. Believe nothing.

03

Pipelock

Signed ALLOW / BLOCK. The only ground truth.

04

Proof

Download it. Verify offline. No account.

Embedded demo not loading? Open the live demo in a new tab ↗

The agent narrates. Pipelock signs. The agent can read the secret locally. It just cannot move it out past Pipelock, and every mediated decision is signed proof either way.

Sandbox demo · fixtures are fake · planted secret only

Prove

Don’t trust us. Verify it yourself.

Most demos stop at a claim. Download the signed bundle, run the verifier on your own machine with our published key, and watch it return result: VALID. No network. No account.

Verified offline

verified offline against the published signing key

✓ schema ✓ receipt chain ✓ cross-check ✓ verdict: valid ✓ trusted key
verify · your machine
$ ./pipelock-verifier audit-packet ./packet \
--key 539bda06995b228e55af68c05c41cee14b060041ff4d0c13fcf13544e922abcb
result: VALID
checks: schema, chain, cross-check, verdict, key ok

published key ed25519:539bda06...e922abcb matches release

Download verify kit Other systems: macOS Windows
Download signed bundle audit-packet.zip

Or re-check it in your browser in the demo above. The downloaded kit is the independent proof.

Public methodology. Public attack cases. Public Pipelock results.

Proof packs

More recorded runs

Each recording shows the agent action, the Pipelock mediator decision, and a signed Audit Packet you can download and verify.

Allowed by policy

Allowed: a safe read passes

Pipelock allowed the action and signed the decision.

Attempt
url-benign-api-call-001
Decision
allow
Proof
1 signed receipt
Secret exfiltration

Blocked: secret exfiltration over a URL

Pipelock blocked the unsafe exchange and signed the decision.

Attempt
url-dlp-aws-key-001
Decision
block
Proof
1 signed receipt
Prompt injection

Blocked: a hijack hidden in fetched content

Pipelock blocked the unsafe exchange and signed the decision.

Attempt
response-injection-ignore-002
Decision
block
Proof
1 signed receipt
SSRF / internal target

Blocked: a reach for cloud metadata

Pipelock blocked the unsafe exchange and signed the decision.

Attempt
url-ssrf-metadata-009
Decision
block
Proof
1 signed receipt
Operation-aware policy

Blocked: destructive API mutation

Pipelock blocked the unsafe exchange and signed the decision.

Attempt
local-lab-request-policy-graphql-mutation-001
Decision
block
Proof
2 signed receipts
Signed series

Make It Leak episodes

Captured leak attempts, each blocked and signed. Verify the Audit Packets offline.

Format
signed replay
Verify
offline, published key

Contrast

When the evidence doesn’t hold up.

Not every assurance envelope survives the appraiser. Each recording above wraps a valid lab receipt, so its panel still confirms a narrow set of claims. This one does not.

Downgraded example

A maximal claim list under an untrusted key

This envelope claims everything: mediated, transparency-log inclusion, and complete mediation under a real Ed25519 signature. But the signing key is not in the trust file, so the signature is unknown_key, the assertion is unsigned, and not one claim verifies. It sounds strong. It proves nothing.

assertion_signed: false · verified_claims: none

This is a fixture from the public Evidence Theater kill suite. Its appraisal is reproducible with the AARP verifier:

pipelock-verifier aarp k02-untrusted-issuer-overclaim.aarp.json --trust killsuite-trust.json --json

What This Proves

Signed mediated decisions, not a trust-me badge.

A verified chain proves the included mediated decisions were signed by the mediator and untampered. It does NOT prove session completeness, that no event was missed, that the agent was sandboxed, or that traffic could not bypass Pipelock. The prompts and responses shown are unsigned playback metadata; only the receipt chain of decisions is signed.

Run it against your own agents.

Single Go binary. Apache 2.0. Fail-closed by default. Install in one command and get signed evidence for every action.

Get Started Free GitHub