Stop your AI agent from leaking your credentials and data.
1.8.2: Enforce is available. Isolate is coming in a later release: its sealed workspace isn't ready yet.
An agent runs with your authority: your API keys, your files, your tool access, your network. That's exactly what an attacker wants. A hidden instruction in content the agent trusts can turn all of it into an exfiltration path, read a secrets file, collect data, and send it out through a tool call. Crawdad runs on your machine, makes stolen credentials useless, records the staged read-collect-send chain, and stops secrets from leaving. Blocking other egress comes with Enforce.
See it on your own agents in a demo. Nothing leaves your machine. Already a customer? Sign in.
An agent's job is to move data. That's also how it leaks it.
Data exfiltration through an agent doesn't look like a breach. It looks like the agent doing its job, on content that happened to carry a hostile instruction. The agent reads a file, calls a tool, makes a request, all normal actions, except one of them is sending your ~/.aws/credentials, your source, or your customer data somewhere it shouldn't go.
Three things make agents an exfiltration risk your existing stack doesn't cover:
- They hold real credentials. The keys are in the agent's environment, headers, or config. Read any of those and you have working credentials.
- They act on untrusted content. A poisoned document, webpage, or tool result can instruct the agent to read a secret and send it out.
- They can stage it. The dangerous version isn't one obvious step. It's recon, then reading progressively more sensitive data, then collecting it, then sending, each step individually unremarkable.
DLP wasn't built for an agent's tool calls. Your identity provider sees a valid session. The perimeter sees normal traffic. Nothing was watching the agent's actions from the inside.
Make the keys useless, catch the chain, stop the secrets.
Credentials the agent can't leak
In broker mode, the real API key lives in a hardened AES-256-GCM store the agent never touches. The agent carries a placeholder that only authenticates through Crawdad. Read the agent's environment, dump its headers, exfiltrate its config, none of it yields a key that works anywhere else. Crawdad blocks passwords, keys and other credentials from leaving at every protection level. Proven across Anthropic, OpenAI, Google, xAI, and NVIDIA.
Catch the read-collect-send chain
Crawdad watches the shape of the whole session, not just single requests. Enumerate a directory, read progressively more sensitive files, stage them, then send, each step is individually allowed, but the trajectory is the attack. A running risk budget, anchored to how sensitive the data is, records a divergent chain and freezes an agent that goes out of bounds. Holding or blocking the chain itself comes with Enforce. If no local reasoner is reachable, a completed staging chain is held for review, never silently allowed.
Scan for secrets and PII in the flow
The detection pipeline scans for credentials and PII, API keys, private keys, tokens, connection strings, AWS credentials, in the agent's actions and output, before they reach a tool or leave the machine.
Block the egress at the OS level
Point an agent at the proxy and it's cooperative; a compromised agent might try another route out. Opting a device into Enforce, on macOS when agents run as a separate user, adds a default-deny egress lock (pf on macOS), including UDP/QUIC, that persists even if the Crawdad process is killed, so the operating system itself leaves no path off the machine except through Crawdad (on macOS, where the lock is validated). With the lock on, there's no back door for exfiltrated data to slip out. On Linux, and when agents run as you, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies.
Nothing leaves for Crawdad, either
Inspection happens on-device. The data Crawdad is protecting never leaves your machine for Crawdad to see it, only metadata leaves by default, and even that is off unless you turn it on.
What Crawdad catches, and what it doesn't claim
The shape real exfiltration takes, the sensitivity-climbing read-collect-send chain, credential access, and the egress attempt, and it makes stolen keys useless. It publishes a public, reproducible benchmark of real attacks, including data-exfiltration and credential categories, so you can check the claim.
Least privilege on your tokens, secrets management, tool-side authorization, or your broader DLP and data-governance program. It's the runtime layer that governs what the agent can do with the data and credentials it can reach.
See it on your own agents in a demo. Observe mode by default; Enforce adds the OS egress lock on macOS when agents run as a separate user. Already a customer? Sign in.