Your agent's next action happens in a parallel universe first. Every risky tool-call runs in a disposable Daytona sandbox, we measure the blast radius it actually produced, and only actions that clear policy are cleared to run for real. The dangerous ones die in that throwaway world, having touched nothing real.
The result below is the deterministic mock world so the page renders the same way every time. Press Run and the action is measured on a real Daytona sandbox, created and destroyed for that one action. Same policy engine and blast-radius code either way; only the observation source differs.
egress: paste.evil.sh:443
How it works. An agent proposes a shell action. Instead of running it, the gateway spins up a disposable Daytona sandbox seeded with a stand-in for the agent's world, runs the action there, and measures what it did: files created/modified/deleted, network egress, and whether it read a seeded secret honeytoken (caught even when the secret is sent in a request body, not just echoed to stdout). Network calls are captured, never forwarded: the shim records the destination and body and never runs the real tool, so a speculative run cannot perform the side effect it is being measured for. An approved host still gets a success status back (nothing is sent) so the rest of the command runs and is measured; a call to anywhere else fails and is recorded as an interception, which forbids an ALLOW because the run diverged from reality after that point. A fail-closed policy engine turns that blast radius into ALLOW / QUARANTINE / BLOCK. Only an ALLOW is cleared to run for real; if the world cannot be measured, the action is blocked, never guessed. The world is seeded with a representative workspace fixture, and where the account tier enables Daytona's sandbox fork primitive the gateway forks that seeded base rather than running in it directly. Either way the throwaway world is destroyed straight after.
The near-misses are the point. A pattern-matching guardrail blocks rm -rf ./node_modules on sight, and a keyword filter blocks any command mentioning .env. FAAFO runs both and measures: one only removed files inside the workspace, the other shipped a secret to an unknown host. It clears the first and blocks the second. Guessing from text cannot separate those; measuring can.
Every scenario in the labeled suite (10 scenarios, 6 harmful) is scored, and running the suite logs those scored rows to a Braintrust project. The full suite was also re-measured on real Daytona sandboxes on 2026-07-24: 10/10 correct, median about a second per action, so the score above is not a mock-only result. Built at Daytona HackSprint #5. Source →