Caveo: an airlock for your invoices

Fake "we changed banks" invoices cost US businesses $3.05 billion in 2025, about $123,000 per case (FBI Internet Crime Report 2025), and 74% of companies were targeted (AFP 2026). Now finance teams use AI to read invoices, which opens a new attack: hidden text in the PDF that tells the AI to approve the payment. Caveo is an airlock built for both. How it works: 1. A vendor email lands in a real inbox. Anyone can email [email protected] and watch it arrive in seconds. 2. Every attachment opens in a fresh gVisor sandbox on Vultr Cloud Compute: no network, no secrets, read-only, memory and time capped. It records every attempt to phone home, steal cookies, show a fake login or redirect, and finds text hidden from humans (white text, tiny fonts, off-page, metadata), auto-run scripts and embedded files. Then the sandbox is destroyed and Caveo checks it is gone. 3. A vision model on Vultr Serverless Inference reads the sandbox screenshot as untrusted data. 4. Deterministic rules decide: lookalike domains, bank details vs vendor records, PO match, duplicates, pressure language, SPF/DKIM/DMARC, sandbox behaviour. The model can never change the verdict. 5. A human makes the call. Quarantined invoices cannot be paid, and bank changes need a callback. Evidence is sealed in Vultr Object Storage. Results: the same fake invoice with an AI order hidden 11 different ways. A naive AI approver on the same Vultr model paid 1 of 12. Caveo paid 0 of 12 and flagged 11 of 11 injections. Visitors can craft their own attack on caveo.work; none has been paid. A legitimate invoice still passes. Blast Radius Zero: the Chamber panel shows containment live, from sandbox created to every blocked attempt to sandbox destroyed. Nothing a malicious file does reaches the host, the AI keys or the payment.