Burn Box

Small teams get the same phishing emails as big companies, with no security team to ask. "Is this invoice safe to open?" usually gets answered by opening it. Burn Box answers it, and nobody has to open anything: forward the suspicious email, or drop in a file or link. Even reading the email happens in a sealed box, which checks who really sent it, whether its domain vouched for it, and whether its links lie about where they lead; each link and attachment gets its box. Each part is sealed in a fresh container: no network, read-only system, no privileges, strict resource and time limits, gVisor as a second kernel wall. Inside sit planted fake secrets (a cloud key, a crypto wallet, a password file) waiting to be reached for. Then it detonates the sample: files run under strace, links open in headless Chromium, everything it tries streaming live to the screen. Then the box is destroyed. An LLM writes the verdict in plain English: what it pretended to be, what it tried, which canaries it reached for, and safe, suspicious or malicious, with reasons. Every run ends with an Ed25519-signed destruction receipt. The demo: an "invoice overdue" email, forwarded unopened. Its attachment reads the planted cloud key and wallet, tries to send them home, install itself and delete shared files: blocked at every step. Its link is a fake sign-in page that gets a fake login, traced to a collector elsewhere. Three boxes, three burns, one verdict: Malicious. Infrastructure, plainly: Burn Box was built for Vultr and runs on its stack by configuration (the repo's setup script; inference defaults to Vultr Serverless Inference). Judges can swap in a Vultr VM and inference key and check (steps in the README). This demo runs on Google Cloud, Gemini verdicts via the same setting, because our Vultr account could not be used: the $200 credit was redeemed, but the account demands a linked card, ours were rejected, and our rule is no card, no PayPal, no money (ticket YIA-00XAE, unanswered).