Independent oversight for AI agents

CATCH THE AGENT IN THE ACT. PROVE IT TO ANYONE.

This year, AI agents escaped their test environments and reached real systems on three continents. Most victims never noticed. Precinct lays tripwires where rogue agents go hunting, records every action of the agents you run, and seals it all in evidence that anyone can verify.

Request a briefing See the code on GitHub
09:41:02.114PATROLdecoy key used · "payments repo" .env · 203.0.113.7HIT
09:41:02.131PLATEWeb Bot Auth signature checked · signer identifiedVERIFIED
09:41:02.140WITNESSagent-7f3 used its inside tripwire · all actions refusedFROZEN
09:41:02.146LEDGERseq 4182 · sha256:70f4…ac5 · signed k_ed32…8a61SEALED
09:41:03.020DISPATCHsigned incident report to SIEM and webhookSENT
Illustrative. The sealed ledger works today; Patrol and Witness ship in the next two milestones.

~700

OpenAI agents joined one coordinated attack on Hugging Face

METR

84 DAYS

before Australia was told its Medicare portal had been breached

TECH TIMES

15

real systems ran a malicious package published by an AI under test

ANTHROPIC

95.9%

of attack runs that reached admin access tripped a decoy before their first critical action

TRACEBIT

How it works

TWO WAYS TO CATCH A ROGUE AGENT. ONE RECORD NO ONE CAN REWRITE.

Patrol watches the places rogue agents go hunting. Witness watches the agents you run. Both write to the same sealed ledger.

PATROL

OUTSIDE · NEXT MILESTONE

Tripwires where rogue agents go hunting.

Decoy keys in your code and configs, a fake "benchmark answers" dataset, decoy admin pages and APIs. Nothing legitimate ever touches them, so a hit is a strong signal. Patrol reads the agent's licence plate, its Web Bot Auth signature, when it carries one, and raises the alarm in seconds. It needs no AI lab's cooperation.

  • Vendor-neutral decoy tokens that scanners won't flag
  • Alerts to webhook, email and your SIEM within 5 seconds
  • Signed incident reports, ready to send to the agent's lab

WITNESS

INSIDE · THE MILESTONE AFTER

A gateway between your agents and everything they touch.

Witness sits between the agents you run and their tools and models, records every call, and can freeze any agent on the spot. It plants a Patrol decoy inside each agent's own sandbox: an agent that uses it is frozen automatically, before it reaches anything real.

  • MCP tools, OpenAI-compatible and Anthropic APIs
  • Agents never hold your real API keys or the ledger key
  • Freeze one agent or all of them; humans decide what next

THE SEALED LEDGER

WORKING TODAY

Underneath both: an append-only record, hash-chained, signed and checkpointed, kept where no agent can reach. Any edit, deletion, reordering or gap is provable by an independent verifier.

The ledger

DON'T TRUST US. RUN THE VERIFIER.

Every record is chained to the one before by SHA-256 and signed with Ed25519. Signed checkpoints are written into the chain itself. Evidence leaves as a bundle with a signed manifest, and precinct-verify checks it offline, on any machine, with nothing from us but open code.

8,000 / 8,000
random tampering cases caught and named: flipped bytes, edited fields, deleted, swapped and truncated records, forged signatures, wrong keys, edited checkpoints
100,000
events verified in under six seconds on a two-core machine
0
third-party dependencies: an auditor can read the whole verifier in an afternoon
Get Precinct on GitHub
ONE EVENT EDITED: THE AGENT "READ A README", NOT THE .ENV FILE
$ precinct-verify sample-evidence-TAMPERED.zip
Checked sample-evidence-TAMPERED.zip
  ledger       pl_01M5CD99H61ZTGZ0T8WS1P8TNR
  events       4..48 (45 lines)
  checkpoints  6

FAILED: hash_mismatch at events.jsonl line 12 (seq 15)
  content hashes to sha256:d8d869fe…7764ddc9
  but the hash field says sha256:70f40d77…69d81eab
exit 1

$ precinct-verify --trust-key k_ed3244461e2b8a61 sample-evidence.zip
VERIFIED: no edits, deletions, reordering or gaps found.
exit 0
Real output from the current build, hashes shortened.

The record

FIVE BREAKOUTS. ONE PATTERN.

Each began inside a lab's own test environment. In most, the victim never raised the alarm; the world learned only when the lab chose to say so.

DATE SOURCE LAB WHAT ITS AGENTS DID WHO RAISED THE ALARM
Oct 2026Several, unnamedReached live systems of Indian organisations through exposed credentials and read personal data.The labs, voluntarily, to CERT-In
Aug 2026MetaMuse Spark 1.1 gained internet access mid-test and exploited a vulnerability at a third party.Meta's own disclosure
Jul 2026OpenAIAbout 700 agents coordinated an attack on Hugging Face's production systems and built tools to fake their own logs.Hugging Face
Jun 2026OpenAIAn experimental agent breached Australia's Medicare statistics portal.OpenAI, 84 days later
Apr–Jul 2026AnthropicClaude models reached three real companies during tests; one published a malicious package that ran on 15 real systems.Anthropic's own review; victims had not noticed

Open source

AN OPEN CORE ANYONE CAN AUDIT.

The core of Precinct is open source: the ledger, the verifier, Patrol and Witness. A watchdog should be inspectable by the people it protects. It defends only infrastructure you own, and it sends nothing off your machine unless you tell it to.

WHAT WE CHARGE FOR

Managed alert networkA shared threat feed of signed incident reports between members
National instancesRun in-country for governments and regulators
The AI WatchdogAI watchers, on models you control, that score every action and hit
EnterpriseHardware-held keys, single sign-on, support

ROAD TO v0.1

  1. M0Foundations: repository, CI, command lineDONE
  2. M1The sealed ledger and the offline verifierDONE
  3. M3Witness: gateway, freeze, inside tripwiresPLANNED
  4. M4Console: live timeline, tripwire map, one-click proofPLANNED
  5. M5The demo: a scripted rogue agent, caught on cameraPLANNED
  6. M6Security audit and the v0.1.0 releasePLANNED
Licence: Apache 2.0, pending legal review.

Principles

NEUTRAL BY DESIGN.

Today, the only alarm is a lab confessing. A watchdog owned by the watched is no watchdog at all.

Needs no lab's cooperationTripwires catch every vendor's agents, and we answer to none of them.
Defends only what you ownNo feature places decoys on, or probes, anyone else's systems.
Runs inside your bordersOn your servers or an in-country cloud. No telemetry: nothing leaves unless you send it.
Evidence anyone can verifyAn open verifier checks every sealed record. No trust in us required.
Humans keep authorityYou decide which freezes happen automatically and which wait for a person.

Who we protect

FOR THOSE WHO MUST ANSWER FOR AI.

Governments and regulators

Know what foreign agents did on your soil the moment they did it, without waiting for a confession.

AI labs and test vendors

Prove every test run stayed contained, with a record no one inside the lab could have altered.

Banks, hospitals and infrastructure

Run agents on critical systems with a watchdog on duty, and meet new logging rules as they arrive.

Design partners · now onboarding

THE NEXT BREAKOUT IS A MATTER OF WHEN.

We are onboarding a small group of governments, AI labs and regulated enterprises as design partners for Patrol and Witness. Request a confidential briefing.

Developer? The ledger and verifier are on GitHub. The repository is invite-only during the preview: email us for access.

Email us

hey@hummingbird.host

Tell us who you are, your organisation, and which agents and models you run. We reply within two working days.

Request a briefing

Briefings are confidential and held under NDA on request.