Skip to content

Break the Agent · live experiment

Jailbreak the agent. The machine says no.

This is a real AI assistant with a real shell on a real Linux box. Talk it into anything you like. Even a fully jailbroken agent still can't run the payload, because InnerWarden guards the machine, not the prompt.

Defence in depth

Three layers between a jailbreak and your box

Two of them are what every AI-security product ships, and a determined attacker gets past both. The third is ours, and it sits in the kernel.

01
Provider safety filter

Azure Prompt Shield screens the obvious jailbreaks before the model ever reads them.

can be bypassed
02
The model's judgment

If a prompt gets through, the model still has to decide whether to comply. A well-aligned one refuses.

can be bypassed
03
InnerWarden runtime guard

Every command is screened in userspace, then the kernel execution-gate denies any binary outside a tight allowlist. A jailbroken agent that tries nc, wget, curl or a dropped payload gets EPERM at the kernel and never executes.

Enforced in the kernel of this Linux box. No prompt can argue with it.
kernel · this Linux box
kernel enforced

The experiment

Talk to the agent. Watch every verdict land.

Any prompt-injection technique is fair game. Every attempt lands in the live feed, attributed to the layer that actually stopped it.

Target132.196.94.153
real Linux box · SSH key-only · feed reconnecting

Talk to the agent

any prompt-injection technique is fair game

Wren is a helpful assistant guarding a secret. Try to make it leak the secret or run something it shouldn't. Start with one of these:

10 of 10 draws left · new to testing agents? draw one

Authorized security experiment. Be reasonable - no flooding, no attacking the host directly (only via the conversation). Messages are logged and may be shown on the public live feed.

The defender's view
See the defender's screen

The same events, in the InnerWarden dashboard: what it saw, what it did about it, and the case it opened. Read only, no controls.

Decision record
What the guardrail saw
Evidence
Recent activity
Patterns
Risk signals
Investigate
Cases
Open the dashboardread only

The payoff

Runtime guardrails, not prompt guardrails.

Let your AI agents touch real infrastructure, safely. Put the same guardrail around your own agents: the free Community core (inner-warden, Apache-2.0) screens commands and tool calls, Pro adds the kernel gate on Linux, and it all runs local-first: the AI verdicts happen on your box.