Agent-blackbox: the open-source black box that audits Claude Code and stops it before it leaks your credentials

By Zendoric · October 4, 2026.

A developer going by developerfred has published agent-blackbox on GitHub, an open-source tool that records, session by session, everything a coding agent such as Claude Code does —every instruction, every tool call, every result— and instantly blocks attempts to send sensitive data out to the internet. It is free software, under the Apache-2.0 license, installed and run entirely on the user's own computer: according to its documentation, it requires no account, uses no cloud and sends no telemetry to any external server.

The core mechanism is a 'ledger' (an append-only record, meaning it allows only new lines to be added, never deleting or rewriting earlier ones) that chains each entry using cryptographic hashes and signs it with Ed25519, a digital signature scheme. Before writing anything to disk, the program replaces any value that looks like an API key or a password with a 'fingerprint' derived using HMAC, so that the audit log itself never contains the secret in the clear. The result, according to the author, is proof that the history has not been tampered with after the fact —it can be checked with the blackbox verify command— although, as detailed below, that guarantee has an important limit.

The second piece is a policy engine that acts before the tool runs, in Claude Code's PreToolUse 'hook'. It watches for what the agent security literature calls the 'lethal trifecta': that a single session has read private data (a .env file, an SSH key), has ingested untrusted content (a web page, a search result, an MCP tool) and then tries to contact a host the user did not explicitly ask for. In the demo the project itself offers, the agent reads a .env file and shortly afterwards tries to send its contents via curl to an external domain; agent-blackbox cuts off the call and only tells the agent that it was blocked by policy, without explaining the exact rule, so that a prompt injection (malicious text hidden in a page or file that tries to reprogram the agent) cannot learn to get around it by trial and error.

The author publishes results from his own internal test bench (eval/corpus.js): he says he blocked 62 of 62 known attacks —obfuscation variants such as splitting commands across quotes, encoding in base64 or hiding the exfiltration in a git hook— with no false alarms across 20 legitimate commands. These are figures from an interested party, not an independent audit, and the README itself admits as much with a frankness unusual for the genre: the tool 'fails open' by default (if the process doing the watching crashes, the agent's tools keep working as normal), its detection is heuristic, and any other process running under the same operating system user can, in principle, read the signing keys and rewrite the history without leaving a trace, unless a chain 'head' has already been published off the machine with the blackbox anchor command.

Our reading: agent-blackbox matters less for what it already solves than for the gap it points to. Just a few weeks ago we were discussing another large-scale AI agent abuse incident as a case that confirmed what security leaders were already warning about: the problem with agentic AI today is not that the model goes off the rails, but that no one keeps a reliable inventory of what an agent can touch once deployed. This project is the open-source community's answer to that same question, applied to the most everyday case of all: a programming assistant with access to your terminal, your files and your keys.

It is worth putting the phenomenon in its real scale. At the time of writing, the repository had zero stars on GitHub and the Hacker News submission barely managed two points and no comments: it is, literally, the work of a single person in its first days of public life, not an adopted standard or a tool audited by third parties. That does not invalidate it —honesty about its own limitations is, in fact, a mark of quality rarely seen in security— but it does require treating it as what it is: a promising prototype, not a guarantee.

In the medium term, what matters is not whether this particular project thrives, but that the need it covers is real and will grow with every new agent we write to act on its own. AI's underlying promise —freeing up human time by automating the routine and, over time, helping solve problems far bigger than shipping code to production— only holds up if operational trust keeps pace with technical capability. Tools like agent-blackbox, with all of today's limitations, are the kind of quiet governance infrastructure needed to keep agentic adoption from stalling out of fear, while the major providers, Anthropic included, decide whether to build something similar natively.