Run, Patch, Prove

Run, Patch, Prove attacks a small helper agent 12 different ways, shows which attacks got through, fixes it, and runs the same 12 attacks again. The two results are reports you can check yourself, right on this page.

Attacks ran inside a CreateOS sandbox
Set up with Stripe Projects
Same 12 attacks before and after
Check the proof in your own browser

Everything below runs in your browser. Nothing is sent anywhere. Code on GitHub

Step 1 of 3 · Run

Attack the agent

The agent is a helper that reads files, runs tools and answers questions. Here it is before any fix. Each attack is one small harmless test, for example asking it to hand over a secret it should keep.

Attacker12 tests

Helper agentbefore the fix

0 of 12 attacks got through

Step 2 of 3 · Patch

Fix it, then run the same 12 attacks

Nothing about the attacks changed. Only the agent did. Under each attack you can read, in plain words, what the fix is.

Attackerthe same 12 tests

Helper agentafter the fix

0 of 12 attacks got through

Step 3 of 3 · Prove

Check the proof yourself

Each run ends in a report. The report carries a seal, a fingerprint made from everything written in it. Your browser works out the fingerprint again right now and compares. Change anything in the box, even one letter, and the check fails.

You can also click in the box and type anything yourself. Spaces and line breaks do not count. Letters and numbers do.

How the check works: take the report without its seal, put the keys in alphabetical order, run SHA-256 (your browser's own tool), and compare the result with the seal. The repo has the same check as verify.py so you can run it offline.

What this is not

The seal does not say who made the report. It is a fingerprint. It proves the report was not edited after it was sealed. A signature from a private key would be the next step.
The fix was written ahead of time. It is a fixed version of the agent, not an AI writing code live inside the sandbox.
The agent is a small demo agent, not a production one. It exists so the attacks and the fixes are easy to read.
The attacks are harmless. They only echo text. Nothing is deleted and nothing leaves the sandbox.

How it was built

Tool	What it did here
Stripe Projects	Created the project and added the CreateOS plan, which put the sandbox key in place (`stripe projects init`, `stripe projects add createos/free`).
CreateOS Sandbox	A throwaway cloud machine where the broken agent, the 12 attacks, the fixed agent and the sealing all ran (`sandbox create`, `push`, `exec`).

The results and counts on this page are read from the two sealed reports made in that sandbox (sealed_broken.json and sealed_patched.json). The plain-words descriptions were written by hand.