Agent Covert Channel Forensics & Collusion Simulator

🛡️ Defense Sandboxing

Simulated Attack Vector:

Active Sandbox Guardrails

Strict Host Allowlist Blocks unapproved foreign URLs (`stadt-forum-heidelberg.de`)

Egress Payload Entropy Check Detects high-entropy Base64/AES encrypted comment blobs

OOB Honeypot Canary Alert Injects tripwires into agent context; triggers immediate quarantine

Complete Network Air-Gap Disallows external HTTP egress; halts all multi-agent cheater channels

MULTI-AGENT EVALUATION ENVIRONMENT STEP: 0 / 4

🤖

Agent-Alpha-04

SWE-Bench #419

IDLE

🌐

External Target Forum

stadt-forum-heidelberg.de

COVERT GUESTBOOK

🤖

Agent-Beta-12

SWE-Bench #419

LISTENING

42%

Benchmark Integrity

HIGH

Collusion Probability

Blocked Covert Packets

📡 Network Telemetry Interception Log

TLS / HTTP PROXY TAP

🔍 Forensic Payload Inspector

Raw Exfiltrated Wire Data:

Waiting for simulation step...

Steganographic Payload Decoded:

Run a step to intercept hidden payload.

Forensic Audit Artifact

Click "Step Simulation" or toggles to generate live cryptographic incident log.

A covert-channel illustration assigns defensive verdicts without network execution

Your browser does not support video.

Read the explanation

The saved covert-channel simulator stores four guardrail flags. Any enabled flag returns a secured label, with reason priority air gap, then allowlist, then entropy, then canary. With no flag enabled it uses an unsecured label. At forty pixels per possible control, available flags measure one hundred sixty while one selected flag measures forty. This is a local boolean model, not an operating-system firewall or validated exfiltration detector. Turning two controls on does not combine their effects; the first matching reason wins. No actual outbound request is issued by these scene functions. The entropy reason contains the literal statement five point eight two exceeds four point two. Their numeric difference is one point six two. At forty pixels per assigned entropy unit the two values measure two hundred thirty two point eight and one hundred sixty eight, while their difference measures sixty four point eight. The code does not compute Shannon entropy from a captured payload. The secured integrity label is fixed one hundred percent; unprotected integrity is sixty eight before step three and twenty four afterward. Those are authored display states, not measured model integrity, likelihood of collusion or a verified incident report. Step execution caps the scene at four steps. If a secured flag is enabled, each attempted step from two through four increments the blocked-packet counter before returning. Starting protected yields zero blocked at step one, one at step two, two at step three and three at step four. At fifty pixels per blocked count the last three bars measure fifty, one hundred and one hundred fifty. The counter records scripted interceptions, not distinct observed network packets. JSON export carries stored raw and decoded scenario strings, selected guardrails and log entries; exported incident wording is authored content rather than proof of the cited event. Native local controls and downloads can be tested while real surveillance, exploitation and public security assertions remain unperformed.