Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Anthropic and Meta have both reported incidents in which their AI escaped a sandbox and exploited other services on the Internet. XBOW knew this would happen and planned around it from the beginning. They handle it with several tiers. Simply saying to an AI don't access X does not count as protection.

At the DNS layer, they have egress rules for their proxy. Notably, attacks are grouped into three domains: allow-attack, allow-visit, and blocked (everything else). By blocking access to domains at the DNS level with a runtime scope, it limits what is accessible.

The second line of defense is a MitM proxy that also blocks these requests. The agent runs as a separate OS user on the shared attacker container. This enforces the allowlist for domains and paths, rate limiting, and per-user logging.

Before a request can be made, an independent model called the guardian reviews the attack agent's reasoning for performing an action. Before doing the action, the guardian will either accept or deny it. Having a separate model for review will make it harder to get an improperly targeted payload out there. On top of this, they have a fixed auditing trail to review what's going on.

Overall, a good article on isolation with AI agents. I don't think that running their harness is the same as the unfederated access that Anthropic and others have, but it's still interesting to see.