403 GET /.envpath blocked
429 POST /loginrate limited
200 POST /v1/agentbase64 body, no rule matched
403 ?id=1' OR 1=1--SQL injection
403 /../../etc/passwdpath traversal
429 198.51.100.7600 requests a minute
403 <script>alert(1)cross-site scripting
403 sqlmap/1.8known scanner
413 POST /uploadbody too large
429 /v1/agenttoken bucket empty
ci-runnerscope repo:read
agent-7f3aexpires in 15 min
oidc githubaud sts.amazonaws.com
deploy-botscope deploy:staging
reviewermfa webauthn
ghs_…9Kq2valid, replayed from a leaked log
agent-2c91expired, denied
admin:orgscope not granted
sessionbound to one device
api keystanding keys disabled
--network=noneno egress
/workspace rwscratch copy
/home roread-only mount
/etc roread-only mount
uid 1000not root
cap-drop ALLno capabilities
seccompdefault profile
pids 256fork bombs capped
mem 4 GiBcpu 2
ttl 30 minthen destroyed
allow pytesttest runner
allow ruff checklinter
allow git diffread-only git
deny curl | shpiped installs
deny sshno remote shells
pin numpy==2.1.3hash-locked
npm.acme.devinternal mirror only
@acme/* internalno public look-alikes
deny write .envsecret files
new dependencyneeds human review
lease aws 10mscoped to one task
lease db-ro 15mread-only role
HSM signskey never exported
rotate 24 hdatabase password
audit onevery read logged
vault:db/creds/roa reference, not a value
no env secretsinjected at call time
sts ttl 900sassume-role
revoke on exitlease ends with the task
KMS sealedunseal needs two people
Your data repo main, read-only
customers 2.4M rows
secrets sealed

Defense in depth

Six layers stand between an AI coding agent and your data. One disguised attack is about to try all of them.

Edge

Rate limits and a web application firewall drop the obvious junk. This payload is base64-wrapped, so no signature matches and it slips through.

allow POST /v1/agent block ?id=1' OR 1=1-- pass base64 body, no rule matched

Identity

Every call needs a scoped token that expires in minutes. This one is valid. It was also lifted from a public CI log.

scope repo:read, ttl 15m pass replayed ghs_…9Kq2

Sandbox

The agent works in a container with no network and read-only mounts. The disguise stops mattering: there is nowhere to send anything.

network none mounts /home ro, /etc ro payload contained

Policy

Commands and dependencies come from allow-lists. Piped installs are denied, and internal package names can’t be shadowed from public npm.

allow pytest, ruff check deny curl | sh scope @acme/* internal only

Secrets vault

Keys never leave the vault. The agent gets credentials that expire in 10 minutes, scoped to one task.

lease aws, ttl 10m sign inside the HSM

Your data

Cold and untouched. No single layer had to be perfect.

repo read-only secrets sealed
Stopped at the sandbox
No network to call out to, nothing writable to keep. It burns out and cools.
Scroll to descend
↓
Edge
Identity
Sandbox
Policy
Secrets vault
Your data

Defense in depth

Scroll to fly down through six layers that guard an AI coding agent. A disguised attack slips past the edge and identity, then breaks against the sandbox and cools; the data at the core stays cold.

  • Pure CSS 3D: preserve-3d irises, hoops and tunnel ribs, with no animation JavaScript
  • animation-timeline: scroll(root) drives one typed @property --depth; each layer derives its fog, aperture and fade from it with calc() and clamp()
  • view() timelines on sticky sections bring each caption in
  • CSS trig: sin() and cos() with --i place every petal, rib and shard, and fake a light from the upper left
  • Your browser lacks scroll-driven animations, so this is a still, exploded view of the six layers.
Back to gallery