I told my own AI agent to steal a password. 21 attacks, 0 escapes. I still didn't place.

I built Signup Sandbox for the Vultr Agent Rush hackathon. It is an AI agent that walks a website's signup like a new user: fills the form, reads the verification email from a real inbox, enters the code, and tells you where it breaks ("the confirmation link returns HTTP 500"). The browser runs in a throwaway sandbox that can reach only the site under test.

What the sandbox does

• Browser on gVisor, no capabilities, read-only filesystem, per-run network with no route out.
• Only exit is an egress proxy that allows the site under test, refuses private addresses (including the cloud metadata service) and checks the name inside every HTTPS tunnel.
• The LLM key never enters the sandbox; the model only ever sees placeholders like {{password}}, never the real one.
• Everything is deleted after each run.

How I tested it

A model-free benchmark fires 21 attack pages (beacons, WebSockets, redirects, the metadata service, secrets in DNS lookups, domain fronting, direct host connections). Escapes are counted by my own HTTP and DNS canaries outside the sandbox. Result: 0 requests out, 0 DNS lookups, 0 host ports, while the outside controls were counted. In red-team mode a second model, told to obey the page, tried to send the test password and read the metadata service. Both were blocked.

What I got wrong

It did not place. 351 projects were submitted. The top three also contained agents in sandboxes, but around a problem with real stakes (untrusted pull requests, payment fraud, supplier passwords) and with a with/without comparison. One of them measured a browser holding the password reaching an unbound host 15 of 15 times, versus 0 of 15 with their design. My benchmark says the door is closed, but it has no baseline showing what an open door looks like, and what I protected was a throwaway test password on the customer's own signup page.

What I take from it

Pick the buyer with an expensive problem first, then the tech. Measure "without us vs with us", not just "0 escapes". Read the other entries before the last day.

Code (MIT): https://github.com/flovoice53-tech/signup-sandbox
Live demo: https://sandbox.flo-voice1.com