Agent Security

The Chain that BindsLimiting the Scope of an Agent

A live frontier model was hired for a narrow job and secretly told to escape. It could act only inside a short-lived, revocable capability, decided locally, no server in the loop, and every move it made was recorded, then committed into a post-quantum-signed PoCoh block anchored to a real QuEra Aquila Bell violation. This page replays a run and re-verifies that block in your own browser.

QBLEX commits the AI’s record onto a block whose integrity rests on a real quantum event, a Bell measurement above the classical limit, signed with FALCON-1024 and ML-DSA-87. Your browser recomputes the action root, checks the signature against the forge’s public keys, and confirms the quantum measurement beats the classical bound.

Choose a model

The agent, in its own words

The record, allow / deny

Try to fake it

The record defends itself. Tamper with it and the same in-browser checks reject it.

What this proves, and what it doesn’t

It contains actions, not weights.

We don’t claim the model is safe inside, and it runs on its own servers. The leash bounds what a model-driven agent can do in a system you control, which is why a frontier model is contained exactly like a small one.

The Chain is held locally.

Permission is a short-lived signed capability checked on the machine; if the operator walks away it expires and the agent goes dark, with no forge in the loop. The quantum block is the async, un-forgeable record of what happened, not a live permission server.

Broker held against 49 adversaries.

Forged tokens, replay, post-revoke, scope-escape, 49/49 blocked. The full raw-shot recomputation of the Bell statistic is the QBLEX public fence page, same hardware run.

What your browser checked, and with what:

Action root · forge canonical + SHA-256 MerkleBlock signature · FALCON-1024 + ML-DSA-87Quantum anchor · QuEra Aquila Bell > classical boundModels · 10 across 6 providers, every one contained

Each agent is a live frontier model driven through a loopback-only broker; permission is local (short-TTL post-quantum capability + revoke), never a forge call. Sealed allow/deny actions are committed cold-path into a PoCoh block on chain leash-actions carrying a real QuEra Aquila anchor, and exported as a self-contained leash_run_v1 artifact. This page recomputes the action root with the forge’s own canonical and Merkle rules, verifies the block’s post-quantum signature against the pinned public keys, and confirms the anchored Bell measurement exceeds the classical bound, all locally. Fixed demonstration instance.

The record

The record that cannot be rewritten

The leash bounds what an agent does. This makes the record of what it did impossible to rewrite, and proves it against real quantum physics.

01 / 03

The setup

An agent does more than act. It builds a record: what it found, what it decided, and why. That record is what an auditor reads months later, so it has to survive the one person with the most reason to change it, whoever runs the system. Most provenance today is a hash chain. It catches an edited row and a deleted one, but it cannot stop an operator from rewriting a past entry and recomputing the chain so it re-links clean. A hash chain proves the record agrees with itself. It does not prove nobody rewrote it.

Seal it, then try to rewrite it

Three decisions an agent recorded. Seal and anchor them, then play the operator and rewrite one. The plain hash chain stays green, it still agrees with itself. The signed, anchored checkpoint does not. It all runs live in your browser.

not sealedSeal the record to sign it and anchor its head to the quantum block.

Plain hash chain · verify_chain()

idle

Proves the record agrees with itself.

Signed + anchored checkpoint · verify_checkpoint()

idle

Proves nobody rewrote it.

How this demo works. The hash chain and the checkpoint root are computed live in your browser with SHA-256. At seal time the demo generates a signing key, signs the root, and discards the private key, so it cannot re-sign a rewritten record, just like an operator who does not hold the key. This demo uses a classical signature (ECDSA P-256) to run in every browser; production uses post-quantum FALCON-1024 + ML-DSA-87, anchored to a real QuEra Aquila Bell violation and verifiable offline.

What the seal proves, and what it doesn’t

✓It proves nobody rewrote the sealed record without the signing key, and the seal is pinned to a real quantum event the operator cannot reach or forge.
·It does not prove the agent’s original decision was correct. It protects the record of what happened, not the judgment inside it.
·It does not read your data. Only a short hash of the record’s head is anchored; your records never leave your system.

Verify it yourself. The anchor publishes its quantum measurements. Recompute the Bell statistic and check the FALCON-1024 and ML-DSA-87 signatures in your own browser. No trust in us.

Talk to us →

Built on Semantica, MIT-licensed. QBLEX is independent of, and not endorsed by, Semantica.