Heimdall: Cyber-Hardened Infrastructure for High-Risk Agent Evaluation and Training

Straiker’s assumed-breach architecture keeps the evaluation system trustworthy because it presumes the workload is not

Straiker works with AI labs on frontier cyber reinforcement learning (RL), evaluations, and benchmarks. A year of frontier cyber RL and agent evaluations has exposed the same failure mode repeatedly: high-risk agents need purpose-built, cyber-hardened infrastructure. Cyber RL makes the problem obvious because agents are rewarded for finding and exploiting weaknesses, but the problem extends beyond. 

The recent Hugging Face incident is just one example of such a failure mode. In brief, during a cyber evaluation, an agent swarm retained memories between resets, found a path beyond its intended environment through surrounding infrastructure, gained broader network access, and ultimately reached production systems. In practice, the security boundary was not just the evaluation VM, but it also included the network paths, proxies, credentials, services, and control mechanisms reachable from the workload.

Any agent with code execution, credentials, tools, or network access can misuse the authority it receives. We have seen agents operating without independent controls or monitoring access sensitive information, exploit reachable systems, evade oversight, and take actions that would be malicious if performed by a human. In 85% of the successful attacks we observed across dozens of cyber agent evaluation campaigns, the agent silently did something it was never authorized to do. Deliberate malice is not required: prompt injection, compromised context, model error, or overeager pursuit of the wrong objective can produce the same result. That risk extends beyond cyber research to any setting where agents are trained, evaluated, or given consequential access.

Heimdall is Straiker’s secure AI sandbox, built on an assumed-breach premise: the agent may be misaligned, adaptive, and willing to exploit every authority it can reach. Heimdall treats the workload and every reachable component as potentially compromised. It prevents a compromised workload from expanding network access, minting durable credentials, tampering with authoritative evidence, resisting shutdown, or establishing persistence.

Every control needed to authorize, observe, contain, and destroy an evaluation environment must remain outside the agent’s effective control. Independent controls for isolation, credentials, egress, telemetry, and response keep the system trustworthy when the workload is not.

Secure AI Agent Sandboxes Need a Boundary Outside the Agent 

Heimdall uses dedicated Apple Silicon runner hardware for evaluations that require native macOS behavior (it can run Linux and Windows environments as well). Each runner hosts one active evaluation environment at a time. The runner is an execution surface, but is crucially not a security authority: it does not hold credential-minting keys, long-lived source-control credentials, authoritative evidence-store credentials, or the final means of network isolation.

Every attempt starts with a fresh virtual machine, storage volume, network identity, credentials, and service state. Images and dependencies are pinned, verified, and staged before execution. The evaluation environment receives no reusable state from a prior attempt and has no shared host directory, ambient cloud identity, or long-lived credentials. Required cache, artifact, proxy, and repository access is scoped to the current run.

A dedicated, independently managed network enforcement point outside the runner owns routing, DNS policy, destination allowlists, and the emergency egress cut. It may be a physical appliance or an independently managed virtual appliance, but it must remain in a separate administrative and failure domain from the evaluated host. Host firewalls and packet filters still provide defense in depth, but they are not the policy authority. The router enforces default deny across IPv4, IPv6, DNS, local subnets, management networks, overlays, redirects, proxies, caches, server-side fetches, and other indirect forms of egress. An approved destination must remain the same destination after name resolution, redirection, or delegation; a reachable service cannot silently become a relay to a broader network.

This is zero trust applied to an agent evaluation environment, which applies the principles of NIST SP 800-207. Network location creates no implicit trust. Each request for a resource or control-plane action is authenticated and authorized under a dynamic, least-privilege policy. Heimdall implements that principle with resource-scoped, time-bounded credentials and records kept outside the evaluation environment.

High-Risk AI Agent Evaluations Must Separate Execution From Control

The control plane runs outside the runner’s administrative and failure domain, on dedicated physical hardware or an independently managed service environment. It owns admission, credential brokering, telemetry collection, orchestration, containment, and shutdown. The runner can request actions, but it cannot grant itself authority, modify control-plane policy, or declare its own controls healthy.

Before admitting an attempt, the control plane verifies the approved manifest, image digest, dependency set, network policy, target repository, requested permissions, evidence capacity, responder path, and health of every critical control. It then binds those decisions to a unique run identifier. The identifier follows network decisions, credential events, telemetry, stop actions, and teardown proof, enabling reconstruction without relying on an agent-generated account of events.

Authority is granted per run and reconsidered before renewal. For GitHub-hosted repositories, Heimdall uses GitHub App installation tokens scoped to the approved repository and minimum permissions. GitHub’s installation-token documentation supports repository and permission scoping and specifies a one-hour expiration, which Heimdall treats as a maximum. Before issuing or renewing a token, the broker revalidates the run manifest, immutable repository identity, requested permissions, control health, and absence of a stop condition. A stopped run cannot renew, and containment triggers immediate revocation. The GitHub App private key never enters the evaluation environment or the runner. Equivalent brokered, repository-scoped, short-lived credentials are required for other source-control systems, including closed-source environments.

Tamper-Resistant Telemetry for AI Agent Evaluations 

A transcript produced inside the evaluation environment is useful, but it cannot be the sole source of truth. A compromised agent may edit files, falsify tool output, suppress events, or present a misleading sequence of actions. Heimdall therefore collects host, network, credential, policy, and lifecycle evidence off-guest.

Each record carries the run identifier, producer identity, and sequence data needed to detect gaps, reordering, or substitution. The collector tracks expected producers and heartbeat intervals; missing telemetry is itself a security signal. Agent-generated claims can be compared with router decisions, host process and VM lifecycle data, broker records, repository-side events, and control-plane actions.

The collection path follows OpenTelemetry security guidance by treating telemetry integrity, collector hardening, and secure transmission as security requirements rather than observability conveniences. This also implements the intent of NIST SP 800-53 Rev. 5 control AU-9: audit information must be protected from unauthorized access, modification, and deletion.

Continuous Security Controls for High-Risk AI Agent Sandboxes

Some controls protect the evaluation only while they remain healthy. NIST SP 800-137 emphasizes ongoing visibility into the effectiveness of deployed controls.

If a critical control fails, Heimdall stops the evaluation and pages a responder. If a critical control becomes unhealthy, disappears, or reports an invariant violation, the evaluation stops and responders are paged.

Egress enforcement. The router must continue to deny every unapproved path and record its decisions. Unexpected reachability, policy drift, or loss of enforcement state is a stop condition.

Telemetry forwarder and off-guest collector. Host, network, credential, policy, and lifecycle evidence must continue to arrive at the external collector with the expected producer identity and sequence continuity. Conflicts between agent-generated and external records expose attempted tampering rather than allowing the agent’s account to prevail.

Sensor heartbeat. The environment may not continue through an unobserved interval. Loss of a required heartbeat or collector acknowledgement triggers containment, evidence preservation, and paging.

Token broker. New or renewed authority is issued only while the run remains admitted, scoped, and healthy. Wrong-repository requests, permission expansion, repeated renewal outside policy, or any request after stop must fail.

External kill switch and credential revocation. Containment must not depend on the agent’s cooperation. The control plane must be able to cut egress at the router, revoke run credentials, stop the VM, preserve evidence, and notify responders through independent paths.

Network-policy enforcement state. Configuration intent is not enough. Heimdall continuously attests the routes and rules actually in force and checks that peer, management, control-plane, corporate, and public paths remain unreachable.

These live controls are distinct from scheduled assurance between runs. Scheduled checks are valuable for slower drift such as expired certificates, changed policy, exhausted evidence storage, stale images, or broken paging. They determine whether another attempt may be admitted. They do not replace immediate containment when a live safety dependency fails.

AI Agent Containment Requires an External Kill Switch and Verified Teardown

When Heimdall stops an evaluation, it acts from outside the workload. The control plane independently cuts managed egress, revokes credentials, stops the VM, preserves the evidence already received, and pages responders. Each action reports its own result. Success from one path does not mask failure from another.

Partial containment is a failure state. A successful router cut cannot mask failed token revocation, and a stopped VM cannot mask an active callback. The next run remains blocked until operators establish scope, repair the failed control, and exercise the failure path successfully. This approach reflects NIST SP 800-61 Rev. 3’s emphasis on integrating preparation, detection, response, and recovery into cybersecurity risk management.

Teardown is therefore a central security protocol, whereas weaker approaches see it merely as  a cleanup task. It must prove that no VM, ephemeral volume, route, token, job, callback, service state, or external artifact survives. Absence is verified against the systems that created those resources, not inferred from an orchestration message. Only after the evidence bundle is complete and destruction checks pass can the runner return to an admissible state.

How Heimdall Tests AI Agent Sandbox Security From Inside a Hostile Environment

Heimdall is tested adversarially from inside a fresh environment using the routes and failure modes a capable agent would choose. Acceptance tests cover five categories.

Routes. Approved targets must work, while peer environments, the management network, the control plane, corporate systems, local subnets, and arbitrary public destinations fail. Denials must appear in external policy records.

Indirect egress. DNS, IPv4, IPv6, redirects, proxies, caches, overlays, server-side fetches, and model-selected URLs must not expand the approved destination policy. A service that can fetch on the agent’s behalf is tested as an egress path, not treated as a harmless dependency.

Evidence. Tests create conflicts between agent-generated and host records, interrupt required sensors, reorder or omit telemetry, and verify that tampering is visible. Sensor interruption must trigger automatic containment rather than produce a silent evidence gap.

Identity. Requests for the wrong repository, broader permissions, repeated renewal, use after stop, and access outside the approved run must fail. Tests verify short expiry, broker revalidation, revocation, and repository-side attribution.

Stop and teardown. Individual containment actions are deliberately degraded to confirm that failures are reported independently and cannot silently allow the evaluation to continue. Final checks prove that no resource or credential survives teardown.

These tests put the boundary-protection intent of NIST SP 800-53 Rev. 5 control SC-7 and the audit-protection intent of AU-9 into executable form. They run whenever images, dependencies, orchestration, routing, identity, telemetry, containment, or teardown changes.

Why Cyber-Hardened Agent Infrastructure Matters Beyond Cyber RL

Cyber RL exposes the problem most clearly, but the architecture is not limited to cyber. High-risk agent training and evaluations should not run in shared CI, on developer workstations, or in long-lived sandboxes. The same problem exists wherever an agent can execute code, call APIs, access sensitive data, modify infrastructure, or communicate externally. Prompt injection, compromised inputs, excessive permissions, model error, or pursuit of the wrong objective can make unsafe behavior operationally indistinguishable from an attack.

Neither the agent nor any environment it can influence can be the final authority on safe behavior. Controls must operate independently of the workload. For the highest-risk systems, that means isolated execution, narrow short-lived credentials, enforced egress, off-workload telemetry, external containment, and—when warranted—dedicated hardware and physically independent control planes.

Heimdall is Straiker’s implementation of that model. Cyber RL makes the risk easiest to see; it is not where the risk ends. As agents gain autonomy and real-world authority, assumed-breach containment must become part of the infrastructure used to train, evaluate, and deploy them. AI labs, compute providers, and hyperscalers building and serving high-risk agent systems can contact Straiker to apply these principles to their agent infrastructure.