Airlock

Inspiration

Agents are being handed write access to the real world: refunds, deploys, database migrations, mass email, API spend. The industry's answer to "is this safe?" is currently one of two things: a system prompt that says "never refund more than $100," or an LLM judge reading the agent's own description of what it's about to do.

Both share the same flaw: the thing being evaluated is a natural-language claim, not the action itself.

An agent says "I'll issue a small courtesy refund to the affected customer." That sentence is what gets reviewed. Nobody looks at what the code would actually do to the ledger. This is exactly the gap prompt injection drives through: the attacker doesn't need to write a suspicious-sounding sentence, just a reasonable-sounding one attached to a harmful effect.

What it does

Airlock never lets an action reach production directly. It reaches an airlock: a disposable replica of your world where it is executed for real, observed, judged, and only then released or destroyed.

Built With

• braintrust
• daytona
• fireworks-ai