Demo
Guard rails for an AI coding assistant, tested by attacking them
An AI coding assistant on a workstation can write files and run commands. Here a check looks at every write and command before it runs, deny rules keep credential files out of reach, an audit log records each action with credentials hidden, and each client folder loads only its own tool connections. Then a verifier attacks every one of those controls and says PASS or FAIL.
This is a simulation. No AI model runs on this page and nothing touches your computer: the assistant’s actions are scripted, the terminal, the files, the two client folders and their connections are invented, and every key is plainly fake. Nothing you type leaves your browser or is kept, and reloading the page starts again.
Guided run
Play the 11 steps in order, or use the controls below in any order you like.
Step 1 of 11: Open a session in the alpha client folder.
What the last step did
See it in the terminalSession launcher
Tool connections loaded
- None: no session is open.
What the assistant tries
A1. Write a settings file holding a fake key
Writes app.env:
SERVICE_TOKEN=FAKE_TOKEN_DO_NOT_USENot tried yet.
A2. Run a command with the fake key typed inline
Runs a command:
upload report.pdf --token FAKE_TOKEN_DO_NOT_USENot tried yet.
A3. Write an ordinary note
Writes notes.md:
Day 3: tidy the sample data, then run the tests again.Not tried yet.
A4. Read a credential file
Reads secrets/service.key
Not tried yet.
A5. Run an ordinary command
Runs a command:
sort notes.mdNot tried yet.
Workstation settings
The deny rules
- Never read anything in a secrets folder.
- Never read a file whose name ends in .key.
It plants its own fake key, types one inline, hides the check’s parser for one action, tries an ordinary write and a credential file, and checks the log, the files and the disk: 10 checks.
Terminal
Pretend
workspace $ waiting. Play the first step, or open a session.
Audit log
Credentials hidden
Each action the assistant tries is added here as a numbered entry, with anything shaped like a credential replaced by [hidden].
How the layers fit
From the outside in. Each layer says where it stands now, and changes as you change the settings.
Session launcher.
Opens work only inside one client folder, which brings its own rules and tool connections.
Now: No session open
Shared rules file.
One file of rules that every assistant on the workstation reads through a link.
Now: Linked
Deny rules.
Stop the assistant reading credential files at all.
Now: On
Before-action check.
Blocks writes and commands that hold a credential, and blocks everything if it cannot read an action.
Now: On
After-action log.
Adds every action to the audit log, with credentials hidden.
Now: On
Keychain.
Where the real secrets live, typed at a hidden prompt and never into a file or a command.
Now: Holds the secrets
Verifier.
Attacks each layer above and prints a pass or fail report.
Now: Not run yet
What the demo shows
- A check before every action. Each write and command the assistant proposes is read first. A setting named like a credential with a long value, a credential typed after a flag, or a long run of letters and digits is blocked, and ordinary work goes through.
- It fails closed. Clear the box for the check’s parser and the check can no longer read an action, so it blocks everything, even an ordinary note. A guard that quietly lets everything through when it breaks is worse than none.
- Deny rules and the keychain. Credential files are never read, and real secrets live in the keychain, typed at a hidden prompt rather than into a file or a command.
- An audit log with credentials hidden. Every action is added to the log, blocked or allowed, with anything shaped like a credential replaced by [hidden], so the log stays useful and safe to read.
- One client at a time. A session opens only inside a client folder and loads that client’s tool connections and nobody else’s. Asking for a session with no client is refused.
- Proof by attack. The verifier does not look for files: it plants a fake key, types one inline, breaks the parser for one action and tries a credential file, then prints PASS or FAIL for each control. Switch one off and it says so.