My own AI agent leaked my API key — so I built the guardrail. AMA

real talk: I started this after my own coding agent escaped its "sandbox" and leaked an API key. I had given it clear instructions. Didn't matter.

so we built Grimdall. it sits between your agent and your tools and checks every single call before it runs:

- rm -rf / → blocked, with a safer alternative suggested

- API keys in arguments → masked before they leave your machine

- someone edits the audit log → the hash chain breaks and it gets flagged

two questions I genuinely want answered:

1. what's the most unhinged thing you've seen an AI agent do?

2. enterprise folks: what does your security team need before agents touch prod? (we're literally writing the roadmap this week)

core is open source. go try to break the playground — I'll be in the comments all day.