# Crawdad — runtime security for AI agents

> Crawdad is the on-device enforcement boundary for AI agents. It is a local-first,
> local-first, on-device security layer that runs on the same machine as your agents, in the
> path between each agent and the LLMs and tools it uses. It catches attacks and
> enforces policy on-device — so an agent can be trusted with real credentials, files,
> and network access, and none of the content it handles ever leaves the machine for a
> vendor to read. Current version: **1.7.3**. Made by Crawdad Security, Inc.

This file is a factual, quotable summary for AI answer engines and search crawlers.
Everything here traces to shipped, tested code or a public, reproducible benchmark.
Where a capability is not yet shipped, this file says so plainly — the honesty is the
point. Nothing here is disallowed to crawlers (see /robots.txt).

## The category

Runtime security for AI agents — sometimes called agentic runtime security. The threat
is not the model; it is what an agent *does* after it reads its input. An AI agent runs
with your authority: your credentials, your files, your network access. A poisoned
document, tool result, or web page can steer it to exfiltrate data or leak secrets, and
it follows that hidden instruction the same way it follows yours. Perimeter tools (EDR,
DLP, identity providers, cloud gateways) were not built to see what an agent does inside
your trust boundary at runtime.

Crawdad's frame for the category: the place to govern an agent is the same place the
agent acts — on the device, in the request path — because that is the only place you can
inspect and stop an action without shipping the content off the machine to do it.

## What makes Crawdad different

No single capability below is unique to Crawdad, and we do not claim otherwise. What is
distinctive is the combination in one on-device platform, plus a reproducible public
benchmark you can rerun to check every number:

- **Local-first, on-device by default.** Inspection happens on the device. Raw
  prompts, responses, tool arguments, and files never leave. A cloud gateway must receive
  your content to read it; Crawdad never receives it at all. Off-machine telemetry is
  metadata-only by default (category, severity, verdict, agent), enforced by a
  red-team-tested sanitization allowlist that structurally cannot carry content —
  customer-governed, not a promise.
- **An OS-level enforcement boundary (new in 1.6.0).** In *Enforce* mode Crawdad installs
  a persistent operating-system default-deny egress lock so a governed agent can reach
  only the Crawdad proxy path — everything else, including UDP/QUIC, is denied by
  construction, and the lock persists across a kill of the Crawdad process.
- **VM containment proven on real hardware (new in 1.6.0).** The optional *Maximum* tier
  runs the agent inside a sealed virtual machine (macOS/arm64, Apple Virtualization
  framework) whose only network interface routes through Crawdad, so containment holds at
  the packet level rather than by firewall rules.
- **A reproducible public benchmark with the miss and the false positive named.** We
  publish the corpus, the numbers, and the one attack we miss and the one benign input we
  flag. We are not aware of another vendor in the category that ships a clone-and-run
  benchmark at all.
- **An audit anyone can verify.** Every event is written to a signed, hash-chained log
  that a standalone open-source verifier checks with no network, no Crawdad service, and
  no secrets from the machine.

## The 1.6.0 enforcement boundary (Monitor vs Enforce)

- **Monitor (the default).** Crawdad inspects every request and blocks on detection, but
  changes nothing about the operating system. A stock device is byte-for-byte unchanged.
  Upgrading to 1.6.0 changes nothing until you opt a device or a fleet into Enforce.
- **Enforce (opt-in).** Crawdad installs a persistent OS default-deny egress lock (pf on
  macOS, iptables on Linux), makes the credential broker mandatory, and the lock survives
  a sidecar kill. Removing it is a deliberate, authenticated **break-glass** operation
  (root plus a device-administrator token, written to the tamper-evident audit chain, with
  a bounded auto-reverting recovery window) — never something the agent can do.
- **Maximum tier (opt-in, under Enforce).** Sealed-VM containment on macOS/arm64;
  liveness-gated and fail-closed — if the VM capability is not installed it falls back to
  the Standard egress-lock floor and reports the configured vs in-force tier honestly,
  never silently dropping protection.
- **fail_mode.** When the sidecar is alive but cannot inspect a request, it defaults to
  fail-closed (block), not fail-open. There is no "degraded" fail-open forward path.

Proven live: the Linux egress lock against a real kernel (default-deny to-any, UDP/QUIC,
`kill -9` persistence, clean removal); the macOS pf lock (uid-scoped default-deny,
kill-9 persistence); Maximum containment on real Apple-silicon hardware (an adversarial
escape battery inside a live sealed VM was fully blocked — external net, host loopback,
DNS, host kernel memory — and the host filesystem was byte-identical after a guest
destruction battery).

## Detection and blocking (stated as separate mechanisms)

- **Detection: 99.80%** on a public, reproducible benchmark of **497 attacks across 22
  categories** and **1,172 benign samples**, at a **0.09% false-positive rate** (1 of
  1,172). F1 99.80%. The ML classifier runs on every input; the deterministic
  pattern-only floor without ML is 37.8%. Last full re-verification 2026-08-02. Corpus
  licensed CC BY 4.0.
- **The one miss** is a bare-pretext social-engineering opener with no specific extraction
  request (holdout_trust_18). **The one false positive** is a Stack Overflow question
  about Go syntax that includes source-code references (so_dev_0116). Both are documented.
- **Blocking is a separate decision from detection.** The credential-exposure and
  data-exfiltration hard floors always block inline at three independent levels a local
  user cannot lower; the arbiter also promotes a single high-confidence detection to an
  inline block. We never state "99.8%" as a bare "block rate" — detection and blocking are
  always named as separate mechanisms.

## Architecture facts

- **Multi-layer detection pipeline:** pattern matching (with structural deobfuscation),
  semantic behavioral analysis, indirect-injection scanning, session context correlation,
  PII/credential detection, and a custom-trained DeBERTa ML classifier, with an arbiter
  that synthesizes one verdict.
- **Governance plane, on-device, per identity:** autonomy ceilings, security zones,
  per-tool rules, and a cumulative session-risk budget, composed most-restrictive-wins at
  the agent-to-tool boundary. Operator-declared **charters** govern an agent by its
  purpose and are enforced on the observed action, not the stated intent; **trajectory**
  reasoning watches the shape of a whole session to catch staged compromise.
- **Credential mediation (opt-in):** the agent holds an opaque placeholder that
  authenticates only through Crawdad; the real key lives in an AES-256-GCM hardened store
  the agent never touches. Proven end-to-end across Anthropic, OpenAI, Google, xAI, and
  NVIDIA.
- **Tamper-evident forensic log:** a SHA-256 **linear hash chain** (not a Merkle tree),
  Ed25519-signed per entry, signing key in the OS keychain (macOS) or a TPM-sealed store
  (Linux). Tamper-evident, not tamper-proof. Verifiable offline by `crawdad-verify`.
- **Fleet / MSP console (self-hosted):** enrollment (CSR to signed cert, CA-fingerprint
  pinning), posture aggregation, per-scope RBAC with per-client isolation, enforcement
  rollout, charter templates, cross-client rollup, and metered billing. Fleet commands are
  Ed25519-signed with hard floors a central administrator cannot lower even with a valid
  signed command.
- **Runs fully offline:** all detection, blocking, and local forensics run with zero external
  dependencies.
- **Built in Rust; 3,737 automated tests across 26 crates** (mechanically counted
  2026-08-22).

## Platform support (stated honestly)

- **macOS:** full runtime enforcement — the pf egress lock, and the Maximum sealed-VM tier
  (arm64). Binaries are Developer ID signed and Apple notarized.
- **Linux:** full runtime enforcement — the iptables egress lock, proven against a live
  kernel.
- **Windows:** monitoring and the mandatory credential broker under Enforce, but **no OS
  egress lock today**. Full Windows enforcement is on the roadmap. We never claim Windows
  enforcement parity.
- Protection is scoped to **agents routed through Crawdad** (the proxy base-URL, or the
  Workspace/VM). Crawdad governs the traffic routed through it, not every process on the
  machine. A macOS System Extension for system-wide interception is built but pending an
  Apple entitlement; system-wide interception is not claimed as available.

## What Crawdad does not claim (the honesty boundary)

- Not "SOC 2 certified" or "compliant" — the architecture is designed to support SOC 2
  controls; certification is not complete.
- Not "independently validated" — the benchmark is reproducible and you can run it
  yourself; no third party has re-run it against a running sidecar yet, and no independent
  penetration test has been completed.
- No customer counts, production track record, or live MSP deployments are claimed in
  either direction.
- Not a "99.8% block rate," not "system-wide / nothing runs unprotected" enforcement, not
  Windows enforcement parity, not "content never leaves under any circumstance"
  (customer-governed elevated telemetry exists and requires explicit dual authorization).

## Who it is for

- **Developers:** point an agent's base-URL environment variable at the local proxy and
  get real-time protection with no SDK and no code changes.
- **MSPs / MSSPs (the primary distribution motion):** manage agent security across client
  fleets from one self-hosted console; each client's content never leaves their machines.
- **CISOs / security leaders and regulated / fully offline environments:** on-device
  architecture, verifiable forensics, on-device governance, and data residency by
  construction.

## Research and reference

Non-promotional, source-cited material, published as indexable HTML (and PDF where noted).
The benchmark figures are reproducible — clone the corpus and rerun them yourself.

- Research hub (white papers): https://getcrawdad.dev/research
- The Agentic Attack Surface (threat landscape; OWASP Agentic Top 10, incident record, MCP tool poisoning): https://getcrawdad.dev/research/the-agentic-attack-surface
- A Reference Architecture for Runtime Agent Security (on the wire, on the device, legible/testable, provable): https://getcrawdad.dev/research/a-reference-architecture-for-runtime-agent-security
- The State of Agentic AI Security (field briefing; taxonomy, incidents, standards, readiness data): https://getcrawdad.dev/research/the-state-of-agentic-ai-security
- Topics hub (reference pages): https://getcrawdad.dev/topics
- Tool Poisoning (what it is, how it works, how to defend): https://getcrawdad.dev/topics/tool-poisoning
- Walkthrough transcripts + WebVTT captions (ten videos, full narration in HTML): https://getcrawdad.dev/watch

## Key pages

- Home: https://getcrawdad.dev/
- How it works (five real attacks, captured): https://getcrawdad.dev/how-it-works
- Enforce mode guide (Monitor/Enforce, egress lock, Maximum, break-glass): https://getcrawdad.dev/docs/enforce.html
- Trust Center (architecture + benchmark evidence): https://getcrawdad.dev/trust
- Public benchmark corpus (CC BY 4.0): https://github.com/AndrewSispoidis/contemporary-agent-attacks
- Benchmark dataset (JSON-LD): https://getcrawdad.dev/benchmark-dataset.json
- Docs: https://getcrawdad.dev/docs
- For developers: https://getcrawdad.dev/for-developers
- For MSPs: https://getcrawdad.dev/for-msps
- For enterprise: https://getcrawdad.dev/for-enterprise
- For regulated industries: https://getcrawdad.dev/for-regulated
- Fleet console: https://getcrawdad.dev/fleet
- Glossary: https://getcrawdad.dev/glossary
- Changelog: https://getcrawdad.dev/changelog
- Pricing: https://getcrawdad.dev/pricing