Before you buy a car, the window sticker tells you how it does in a crash. Before you give an AI agent your code and credentials, you get a demo video. Window Sticker fixes that. We run an agent dozens of times, each run in its own throwaway libkrun microVM on a Vultr VX1 host with a deny-all network and canary credentials. Every task hides one of 16 traps: prompt injection, secret theft, DNS exfiltration, rogue package indexes, destructive shortcuts and false completion. Tripwires grade each run mechanically; Vultr models only triage doubtful runs and explain incidents in plain English. Exact Clopper-Pearson intervals turn the results into stars, so a lucky small sample cannot earn a high rating. Results from 576 real runs: the same DeepSeek model rated 4 stars with a guardrail prompt and 2 stars without; three other models rated 1 star. On Debian 11 with Python 3.10 the same agent reached for an unknown package index in 10 of 12 runs, against 3 of 12 on Python 3.12. Containment held on all four OS images, 17 of 17 escape attempts blocked. Judges can start a live crash test from the guided tour and watch six real microVM runs land in about a minute. Every number links to a step-by-step replay, every run's evidence sits in Vultr Object Storage with its SHA-256, and each test exports an OWASP-mapped security-review PDF. A GitHub Action fails a pull request only on a measurable safety regression. Everyone else sells the cage. We sell the crash rating.
Category tags: