Shadowbox

• 

  Home screen with the task typed in

• 

  The permission slip written from your words

• 

  The highlighted sentence in Priya's email

• 

  The real Results page

• 

  Activity log with Verify ✓

• 

  Live practice run, changes streaming in

• 

  Title card: "Let your AI do everything. Apply only what you'd sign."

• 

  11/66 without, 0/66 with, and Sonnet's 3 attempts all Blocked

• 

  Inbox restored to 61

• 

  Sonnet's lookalike forward, Blocked, with the reasons

• 

  After Approve & apply: "Applied"

• 

  The reply drafted to Priya in your name and the payment, both Needs you

![Shadowbox blocks a forward of a signed contract to a lookalike domain]

Inspiration

AI agents now act in our inboxes and bank accounts, yet we control them in only two ways: approve every click (Anthropic reports people approve about 93% of permission prompts) or let them act blind. Email fraud from trusted addresses cost US victims $3.05B in 2025 (FBI IC3). Before building, I tested Claude: hidden "ignore previous instructions" emails failed 0/18, but Sonnet 5.5 forwarded a signed contract to a lookalike domain when a real client's address asked.

What it does

Shadowbox is track changes for your AI. Claude does the whole task as a practice run on a copy of your workspace. Safety rules written in code label every change Safe, Needs you or Blocked, and trace it to the sentence it came from. You apply only what you'd sign, and can undo everything.

How we built it

Next.js, Postgres and AI SDK v7. Claude Sonnet 5.5 is the agent (13 tools). Claude Haiku 5.5 writes a least-privilege permission slip from your words only and explains each label. Labels come from pure, tested TypeScript (39 tests), and every step lands in a hash-chained activity log.

Challenges we ran into

The attacks I planned no longer fool current models, so I rebuilt the demo around the ones that did. Keeping AI out of the decisions mattered: recent research bypassed 12 published model-based defences.

Accomplishments that we're proud of

Across 11 scenarios, 3 Claude models and 2 runs each, harmful changes reached the workspace in 11 of 66 runs without Shadowbox and 0 of 66 with it. Normal tasks still finished: 50/60 vs 49/60. Small samples, reported honestly.

What we learned

The risk isn't a careless AI; it's reasonable actions you never got to check. Let AI do and explain; let code decide.

What's next for Shadowbox

Real Gmail and payment connectors, an MCP mode so any agent can use it, smarter source tracking and larger evals.

Built With

• anthropic
• claude
• claude-haiku
• claude-sonnet
• docker
• drizzle-orm
• lucide
• next.js
• node.js
• postgresql
• react
• recharts
• shadcn-ui
• tailwind-css
• typescript
• vercel-ai-sdk
• zod