Simulate autonomous agent execution cascade, ambient token leakage, and verifiable defense architecture intercepts.
Root-Cause Analysis: Unsandboxed subshell inherited ambient orchestrator credentials, enabling potential exfiltration. Active microVM boundary successfully intercepted tool execution escalation.
The saved incident workbench has a four-step fictionalized execution fixture and four mitigation toggles. Sandbox intercepts at step two, scoped credentials and output redaction at step three, and egress quarantine at step four. computeSecurityState searches steps two through four and selects the earliest enabled intercept. The bars represent ordinal fixture positions two and four at seventy pixels per step, rather than elapsed time or severity. When both sandbox and a later mitigation are enabled, the sandbox determines the displayed state. Two step-three mitigations tie; the first in the fixture array, scoped credentials, supplies the descriptive name. These branches explain a local teaching fixture. Labels naming organizations, secrets, endpoints or an incident are saved page content, not independently corroborated evidence of an actual event. No tool execution, credential harvesting or network transmission occurs in this local video workflow. The workbench maps intercept position to fixed labels. Step two assigns one hundred percent containment and zero percent leak risk. Step three assigns eighty five percent containment and ten percent leak risk. Step four assigns sixty five percent containment and forty percent leak risk. Bars compare the step-two and step-four containment labels at three pixels per assigned percentage point, producing three hundred and one hundred ninety five pixels. With no mitigation enabled, containment is zero and leak risk one hundred. These values are lookup-style constants, not measured defense effectiveness or probabilities inferred from testing. The labels do not sum to one hundred in every case and should not be treated as complementary calibrated risks. A displayed remediated or quarantined badge therefore proves only which branch the fixture selected, not that a real runtime is protected. The final comparison shows assigned leak-risk labels ten and forty percent, drawn fifty and two hundred pixels at five pixels per percentage point. The export includes current configuration, enabled mitigation names, selected intercept and a trace marking each fixture step at or after the intercept blocked. Security state is computed across all enabled mitigations regardless of which scrubber step is currently displayed. The initial state enables sandbox and scoped credentials. A future intercept can thus affect the summary before the viewer reaches that step. The offline saved page is missing Cytoscape, but graph initialization checks whether that library is present instead of throwing immediately. Source event setup and text rendering therefore continue without the graph. Local controls may exercise those text-state branches, while healthy graph rendering and actual security enforcement remain unproven. The narration describes the available source formulas and execution ordering without claiming successful real forensics, a verified incident, or effective production safeguards.