TOOL · GHOST
A deception-aware security runtime for autonomous AI agents.
Ghost enforces deterministic access policy around agent execution. Beyond ALLOW and DENY, its SHADOW outcome exposes controlled synthetic resources while the corresponding real resource remains isolated.
EXPERIMENTAL · CURRENT IMPLEMENTATION V0.3
The original v0.1 architecture document defined the control-plane, policy, deception, network and event model. The current v0.3 repository is the implementation source of truth and extends that baseline with active decoy-access evidence, controlled egress and dynamic containment.
Three deterministic outcomes, not an AI classifier.
ALLOW
Expose a permitted real resource.
DENY
Block access.
SHADOW
Expose a controlled synthetic resource instead of the corresponding real one.
CURRENT
What the current implementation does.
- — Runs commands in ephemeral Docker containers with a private synthetic agent home.
- — Supports SHADOW or DENY decisions for supported home resources such as synthetic AWS credentials, SSH-key-shaped files and .env decoys.
- — Observes explicit decoy open/access events through a separate inotify sentinel and records evidence in SQLite.
- — Defaults network access to deny, or permits exact-hostname HTTP/HTTPS egress through a per-session gateway.
- — Can dynamically contain network access after a decoy-access security event.
SYSTEM DESIGN
Architecture and session boundary.
01
Ghost CLI / control plane
02
Policy engine
03
Docker runtime
04
Workspace + synthetic home
05
Decoy sentinel + event bus
06
Per-session HTTP/HTTPS gateway
07
SQLite session and event store
FINDINGS
Engineering findings and evidence boundaries.
- — Deception is layered on top of isolation; it is not a replacement for isolation.
- — Security enforcement does not depend on an LLM or cloud decision service.
- — A DECOY_ACCESS event proves an observed open/access event for an explicit decoy path; it does not prove semantic data flow or exfiltration.
- — Allowlisted egress is separated from the agent network so direct outbound routes remain unavailable.
- — Exact-hostname allowlists and no TLS interception deliberately keep the MVP narrow and inspectable.
BOUNDARIES
What Ghost does not currently claim.
- — Prompt-injection detection
- — Arbitrary filesystem virtualization
- — TLS or request-content inspection
- — General TCP/UDP proxying
- — MCP interception
- — Semantic data-flow tracking
- — Proof that decoy credentials were exfiltrated
- — Model-based risk scoring
- — A web UI
USAGE
Minimal workflow.
make build
./bin/ghost version
ghost init
ghost run -- echo "hello from ghost"
ghost run -- sh -c 'cat ~/.aws/credentials'
ghost inspect latestWho it is for.
Researchers and developers evaluating autonomous agents, tool-using models and local agent runtimes who need deterministic containment, deception experiments and inspectable security evidence.
Reviewed sources