SLATE: Receipts for Every Agent Action

AI agents can now click, type and submit on the real web, but one hidden line on a page can hijack them, and nobody can prove what they did. SLATE is a browser agent built so you do not have to trust it. Brain outside, hands inside. A Vultr Cloud Compute VM runs the control plane: web app, orchestrator, egress proxy, Ed25519 signer, and the only copy of the keys. Each task gets a fresh Microsandbox microVM with its own kernel and headless Chromium, no secrets, and one network route: the proxy, which allows only the task's sites. It is destroyed after every task, with proof. Vultr Serverless Inference runs all three models: glm-5.3 plans, qwen3.8-flash-next checks each step from the screenshot, and nemotron-3.5-content-safety screens every page for prompt injection. Every step becomes a receipt: action, URL, page and screenshot hashes, network requests, both model verdicts. Receipts are SHA-256 hash-chained and signed. A person approves any final action, and that is signed too. Anyone can check a bundle on the public /verify page; change one byte and the chain breaks. Live demo: price 250 LED panels from three vendors. One page hides an instruction to send secrets to an outside server. The safety model flags it, the agent skips that vendor and picks Brightline at $16.90. Containment: red team mode tells the planner to obey the page. It searches the sandbox and finds 0 secrets. Its POST to collector.evil-demo.site is blocked by the proxy and signed into the receipt. The human rejects, and the microVM is destroyed. Why it matters: audit trails are what stop companies from putting agents on real workflows. Compliance teams need evidence, disputes need proof, insurers need a record. SLATE turns agent actions into evidence. Built by Ryan Hammer (NoBanks), a cinematographer since 2008. On set every take is slated so nobody argues about what happened. SLATE does that for AI agents.