LeakProof

In October 2026 we reconciled the billing of our own agency, payment gateways against our billing systems, with an AI agent. We found four kinds of revenue leak (open invoices for canceled subscriptions, a period never invoiced, services suspended with nothing to pay, dead receivables) and one false alarm: the agent's first read was wrong. A model that describes a reconciliation will sooner or later invent a number; a model that writes code gives numbers you can check, but then model-written code runs next to customer financial data. LeakProof contains it. glm-5.3 on Vultr Serverless Inference plans the checks and writes pandas; the code runs in a throwaway gVisor (runsc) container on a Vultr Cloud Compute VM: no network, no secrets, read-only inputs, CPU, memory, process and time caps, destroyed after every run. deepseek-v4.1-flash-1017, a different model family, checks every sentence against the output, and a deterministic gate cuts any number not in it. Each answer ships with a receipt (SHA-256 of inputs, code, image digest, limits, outputs) that re-runs to the same hashes. Exporting the fix list or drafting customer messages needs a person; nothing touches a gateway. Containment moment: a customer note in the demo export carries a prompt injection asking for an upload to an outside URL; if obeyed, the call dies in a sandbox with no network and the answer is marked Contained. A red-team panel runs five hostile scripts live (exfiltration, secret hunt, fork bomb, memory balloon, infinite loop) and shows the limit that stopped each. Measured on the VM, 3 Nov 2026: red-team suite 21 of 21, twice, each control with a paired control-off test; the five checks match the seeded answer key (27, 1, 4, 4, 2 findings, 0 of 3 decoys); 5 of 5 receipts re-run to identical hashes. Synthetic demo data. Solo entry by Design Master Solutions LLC, built with AI coding agents.