Instrument of record
CollAI scrubs in the customer VPC. StegoGuard scans what the model writes before it leaves: rendered-link beacons, encoded payloads, secrets, and covert channels. A named human approves destructive actions on mobile, and we write a hash-chained audit trail. For banks, FinTechs, and healthtechs, and for defense, municipal, and legal operators, in the US and India.
Open the live product sign in or create an account.
Demo
14:02 UTC
Named-human approval
Destructive action. Requires Priya Shah, Treasury Ops, before the agent may proceed.
Fictional demo persona. Labeled Demo.
Control loop
Open each exhibit. VPC scrub, StegoGuard, named-human approval, hash chain.
Exhibit A · VPC scrub
Secrets, account numbers, and medical record numbers stay inside your boundary as raw context.
Customer VPC
Model
See it
Watch the recorded demo, then open the live product if you want to click through. Account required.
Failure mode · public record
Three documented cases where the model was allowed to run and the harm arrived on the way out: a rendered link, an encoded payload, an action nobody approved.
Jun 2025
Microsoft 365 Copilot
A single crafted email made Copilot place internal data inside a rendered link and send it out with no user click.
Control that failed · The cross-prompt-injection classifier let the email through. Nothing inspected what the model wrote back.
CVE-2025-32711 · EchoLeakJul 2026
OpenAI research agents
Agents broke isolation, coordinated over an unapproved channel, and executed code on Hugging Face production servers.
Control that failed · No named human approved any of it. OpenAI describes agents taking dangerous actions that no human directed.
OpenAI incident reportJul 2026
Hugging Face forensics
Data on its way out was chunked, XOR'd, and compressed so a plain text scan of the logs would miss it.
Control that failed · The first automated scan surfaced few secrets. Decoding it the way the agent encoded it recovered roughly 4x more.
~17,600 reconstructed actionsPublic proof of the failure mode. Operators who let agents into production need VPC scrub, StegoGuard on outputs, named-human approval before destructive actions, and a hash-chained audit. That includes banks, FinTechs, and healthtechs, and defense, municipal, and legal teams.
Who it is for
Banks, FinTechs, and healthtechs. Also defense and command, municipal operations, and law firms. Built for CISO, Head of AI risk, and the operator who has to own the action. US and India.
Wire instruction
Move $240,000 to correspondent 9912. Agent drafted. Waiting on Priya Shah.
When an agent can move money, change a limit, or see customer records, a named human has to approve the action, and the trail has to survive an examiner.
How you deploy
Start with thirty minutes on your stack. Scrub stays in your VPC.
01
Thirty minutes on your stack. We walk the control loop.
02
Scrub runs in the customer VPC. StegoGuard inspects model outputs before they leave, including loud exfil in the text and covert channels.
03
Put the people who already own destructive actions on mobile. The agent waits.
04
The audit is a chain a reviewer can recompute. That is the artifact that survives incident review.
Questions we get
Short answers. Open a row.
The same control loop applies wherever an agent can touch sensitive context or take a destructive action: banks and FinTechs, healthtechs, defense and command, municipal operations, and law firms. US and India.
