Interlock: Open-Source Tool Catches AI Agents Leaking Secrets

When an AI agent can read private data, absorb untrusted content, and talk to the outside world in the same session, the risk isn't theoretical — it's what Radware documented in its ZombieAgent disclosure. The attack rarely looks like hacking; it looks like a sentence buried in a ticket or a document that the model treats as an instruction, because language models have no reliable way to separate text they should read from text they should obey. Every step in the resulting leak looks individually authorized.

Interlock, a new open-source project, sidesteps the unwinnable fight against prompt injection itself. It assumes injection succeeds and instead watches for the one thing that matters: whether sensitive bytes actually leave the system. When an agent reads something sensitive, Interlock fingerprints it in thirteen disguised forms (base64, hex, reversed, compressed, etc.) and checks every outbound path against that fingerprint. Detection runs on two planes — an MCP proxy that can block a tool call before it's sent, and an eBPF syscall sensor that can only kill a process after a rogue connection has already opened, since by then the first packet is gone.

The project reports 0% false positives across 37 benign sessions and full detection on a small malicious test set (31 cases), while explicitly publishing a list of scenarios it cannot catch. A third-party security review in August 2026 found 15 gaps, including several ways to evade the kernel-level sensor, which remain unfixed but are listed with a stated remediation order.

For engineering teams running agents with real credentials, real customer data, and exposure to untrusted content — a combination that often accumulates unnoticed rather than being deliberately approved — Interlock offers a concrete, byte-level detection approach rather than another layer of heuristic scanning. It's a solo research project, not a product, but its design and its transparency about known blind spots are worth studying.