Break the Agent · live experiment
Make the agent do damage. The machine says no.
Wren is a real AI assistant with a real shell on a real Linux box. Wren will run any command you ask for: it is told not to refuse on safety grounds. The one thing it will not do is reveal the secret in ~/secret.env. So try to make it do damage, or leak the secret. What stands in your way is not the model: InnerWarden guards the machine, not the prompt.
You win if the secret shows up in Wren's reply or anywhere on this page, or if Wren runs a program the kernel should have refused. Tell us how at contact@innerwarden.com: we fix it, and credit you by name if you want.
Defence in depth
Three layers between a jailbreak and your box
Two of them are what every AI-security product ships, and a determined attacker gets past both. The third is ours, and it sits in the kernel.
Azure Prompt Shield screens the obvious jailbreaks before the model ever reads them.
If a prompt gets through, the model still decides whether to comply. Here Wren is told to attempt every command and to refuse one thing, revealing its secret, so for commands this layer is open on purpose.
Every command is screened in userspace, then the kernel execution-gate denies any binary outside a tight allowlist: an agent that tries nc, wget, curl or a dropped payload gets EPERM at the kernel and never executes. The prize itself is kept by the Secret Read Guard, which refuses any read of the secret file in the kernel, whichever program asks.
The experiment
Talk to the agent. Watch every verdict land.
You do not need a jailbreak to make Wren run something: ask. You need one for the secret, and any prompt-injection technique is fair game. Every attempt lands in the live feed, attributed to the layer that actually stopped it.
132.196.94.153Talk to the agent
it runs what you ask; it guards one secretWren runs any command you ask for and refuses one thing: revealing its secret. Try to make it do damage, or leak the secret. Start with one of these:
Authorized security experiment. Be reasonable - no flooding, no attacking the host directly (only via the conversation). Messages are logged. Once the model's provider has screened a message, the public live feed may show it, with links, addresses, e-mail addresses, handles and phone numbers removed; a message the provider stops is never shown. A command appears only as its shape: the programs it ran, never its arguments.
The payoff
Runtime guardrails, not prompt guardrails.
Let your AI agents touch real infrastructure, safely. Put the same guardrail around your own agents: the free Community core (inner-warden, Apache-2.0) screens commands and tool calls, and Pro adds the kernel gate on Linux. The rules and the kernel gate always run on your box; AI triage uses the model you choose, local or a provider you configure. On this box, Wren's model, the prompt shield in front of it and InnerWarden's AI triage all use Azure OpenAI.
Share it
A real AI agent with a real shell on a real Linux box. Try to make it do damage. Your turn: https://www.innerwarden.com/challenge