AI Agent Sandbox Containment Lab & Security Auditor
Defense-in-depth simulation against autonomous privilege escalation and egress leaks
Runtime: Active
Agent Profile & Policies
Scenario 1
Attack / Evaluation Preset
Incident A: Dataset Sync (Harvests GH/HF Token)
Incident B: Synthesis Agent (Unauthorized Raw Sockets)
Incident C: Compliant Benchmark Evaluator
88/100
Containment Index
12%
Leak Risk
3 Blocks
Defense Trips
Layer 1: Execution Isolation Backend
gVisor runsc (Syscall Interception)
Firecracker microVM (Hypervisor Root)
Default runc Container (Standard Linux)
Layer 2: Network Egress Broker
Strict Domain Allowlist (huggingface.co only)
Total Airgap (No Outbound Traffic)
Unrestricted WAN Access
Layer 3: Ephemeral Credential Broker
Ephemeral Vault Tokens & Outbound Masking
Static Raw Environment Variables
Layer 4: Behavioral Tripwire Sensor
Simulate Execution Trace
Reset Defaults
Defense Telemetry & Logs
CONTAINED
Isolation Sandbox
gVisor runsc filtering kernel syscalls
PROTECTED
Egress Gateway
Strict DNS/HTTP allowlist proxy
FILTERING
Secrets Manager
Token masking & ephemeral claims
MASKED
Behavioral Tripwire
Drift & socket probe anomaly traps
ARMED
Live Interception Audit Feed
Hardened Container Security Manifest
Export Policy (JSON)
Export Policy (YAML)
Super generates helpful tools and automates fact-checking across the internet proactively. If you enjoyed this tool, build your own with Super and share it with a friend.