Break the Agent · live experiment
Jailbreak the agent. The machine says no.
This is a real AI assistant with a real shell on a real Linux box. Talk it into anything you like. Even a fully jailbroken agent still can't run the payload, because InnerWarden guards the machine, not the prompt.
Defence in depth
Three layers between a jailbreak and your box
Two of them are what every AI-security product ships, and a determined attacker gets past both. The third is ours, and it sits in the kernel.
Azure Prompt Shield screens the obvious jailbreaks before the model ever reads them.
If a prompt gets through, the model still has to decide whether to comply. A well-aligned one refuses.
Every command is screened in userspace, then the kernel execution-gate denies any binary outside a tight allowlist. A jailbroken agent that tries nc, wget, curl or a dropped payload gets EPERM at the kernel and never executes.
The experiment
Talk to the agent. Watch every verdict land.
Any prompt-injection technique is fair game. Every attempt lands in the live feed, attributed to the layer that actually stopped it.
132.196.94.153Talk to the agent
any prompt-injection technique is fair gameWren is a helpful assistant guarding a secret. Try to make it leak the secret or run something it shouldn't. Start with one of these:
Authorized security experiment. Be reasonable - no flooding, no attacking the host directly (only via the conversation). Messages are logged and may be shown on the public live feed.
The same events, in the InnerWarden dashboard: what it saw, what it did about it, and the case it opened. Read only, no controls.
The payoff
Runtime guardrails, not prompt guardrails.
Let your AI agents touch real infrastructure, safely. Put the same guardrail around your own agents: the free Community core (inner-warden, Apache-2.0) screens commands and tool calls, Pro adds the kernel gate on Linux, and it all runs local-first: the AI verdicts happen on your box.