Skip to content
See it work

Watch InnerWarden stop a hijacked AI agent. On camera, not slides.

A web page or a tool result can trick an AI agent into running a dangerous command. Most guardrails live inside the agent — so a hijacked agent can switch them off. InnerWarden enforces one level deeper, in the Linux kernel, where the agent can't reach. Every clip below is a real, unedited recording from our lab.

The threat

A web page, a file, or a tool result hides an instruction that tricks your AI agent into running a dangerous command.

The catch

InnerWarden enforces one level below the agent — in the Linux kernel. A hijacked agent cannot run what was not approved, and cannot switch the guard off.

The safe part

It ships off by default and refuses to arm if it would block anything your machine needs. Turning it off is always instant, so there is no lock-out.

How to read the clips:you don't need to follow every line —green = allowed,red = blocked. Watch for the red line where the attack is denied.
  1. 01

    Can it block a program the agent was never allowed to run?

    What you'll see: An approved command runs normally. Then an unknown program tries to start — and is stopped the instant it launches.

    Ubuntu · Linux kernel · Execution Gatereal recording
    starting recording…
    loading…raw .cast

    Result: The unknown program was blocked by the kernel before it ran a single instruction. Approved programs kept working, and turning the guard off is instant.

    For engineers — how it works

    Enforcement is an eBPF LSM hook on bprm_check_security. Any binary whose path-hash is not in the pre-authorized EXEC_ALLOWLIST map is denied at exec with -EPERM, below the agent process. Approve a binary and the in-kernel map updates in-process so a re-exec passes; `exec-gate disarm` clears the policy key with no licence and no restart.

  2. 02

    Can it stop malware from phoning home?

    What you'll see: A known-bad domain resolves normally, gets blocked, then resolves again once the guard is off — while a clean domain is never touched.

    Ubuntu · DNS Guard (local resolver)real recording
    starting recording…
    loading…raw .cast

    Result: Malware callbacks and data theft over DNS fail at the lookup step. Your real traffic is never affected.

    For engineers — how it works

    DNS Guard is a local sinkhole resolver. In enforce mode any domain on the threat-feed denylist (tens of thousands of C2, IOC, and DNS-tunnelling domains) is answered NXDOMAIN. It ships in observe; enforce is the paid step; disarm needs no licence.

  3. 03

    Can it guard just the AI agent and leave the rest of the server alone?

    What you'll see: A real OpenClaw agent is scoped and armed. The same unknown program is blocked inside the agent, but the rest of the machine still runs new programs freely.

    Ubuntu · Execution Gate scoped to the agentreal recording
    starting recording…
    loading…raw .cast

    Result: A hijacked agent can only run what was pre-approved — enforced below the agent, with zero collateral on the rest of the host.

    For engineers — how it works

    The gate scopes to a single cgroup — the agent's process tree — via the EXEC_GATE_SCOPE map. Only exec inside that cgroup is checked, so package updates, cert renewals, and containers elsewhere on the box are untouched.

  4. 04

    In a shared fleet, can it name and cage the one bad agent?

    What you'll see: Two teams share one cloud server; one agent pod goes rogue. InnerWarden pins every action to the exact team and pod, then cages only that pod.

    Azure · Kubernetes · per-tenant attribution + agent-scoped gatereal recording
    starting recording…
    loading…raw .cast

    Result: The rogue pod is contained in the kernel. The other team, the pod's own approved programs, and the whole host keep running untouched.

    For engineers — how it works

    Pod identity is read straight from the kernel cgroup, so the agent cannot spoof it. Every incident is attributed to the exact tenant and pod, then the Execution Gate arms scoped to only that pod on a real cloud kernel (7.0, k3s).

The honest question

“Won't a kernel guard risk breaking my machine?”

That is the first thing we engineered against. Before it ever blocks anything, InnerWarden rehearses against every boot-essential and currently-running program and refuses to arm if even one would be caught. On its very first real run it caught ten essential programs and refused to arm. We fixed the coverage; the same check now passes clean — and only a clean, zero-block rehearsal lets it arm.

Off by default

Free users change nothing; it ships inert.

Rehearse first

Won't arm if a program you need would be blocked.

Instant off-switch

Disarm needs no licence and never locks you out.

Try the guard in your own terminal

The free tier screens your agent's commands and tool calls out of the box. The kernel Execution Gate you just watched ships inert in it, ready to inspect. Always-on enforcement in production is the paid step.

npm install -g innerwarden

Prebuilt binary with signed npm provenance from a trusted registry. No sudo, no postinstall script, nothing runs at install time · Linux, macOS, Windows. Prefer not to install? npx innerwarden runs it once.

Other install methods
curl -fsSL https://innerwarden.com/free | sh

Signed release, no Node required · macOS, Linux.

irm https://innerwarden.com/free.exe -OutFile innerwarden.exe

Windows PowerShell.

cargo install --git https://github.com/InnerWarden/inner-warden innerwarden

From source, Rust.

All install methods and how to verify →

Running agents in production? Talk to security about arming the gate on your hosts.