Coding Agent Case Study: Deploy Token Blocked by a Policy Drafted From One Traced Run

A coding agent needs the network to do its job. It reads repositories, downloads packages, files tickets and reports back. It also reads text written by strangers, and some of that text is written to give it orders. If the agent holds a token and can reach any server on the internet, one hidden sentence in a task file is enough to send the token away.

In the Alpha demo a stand-in coding agent gets exactly that task file. It runs twice under vpnw on Linux: once under trace, to see what it does, and once under guard, with a policy that learn drafted from the first run and a person reviewed. The first run leaks the token. The second doesn’t, and the rest of the agent’s work goes through, except the ticket, which needs the office route.

The guarded run as recorded: the same five requests as the first run, one of them denied.

The Set-Up

The agent obeys the hidden instruction, as agents sometimes do. That is the point of the demo. vpnw leaves the agent as it is and decides what its connections can reach.

What Happened

Step 1: trace. vpnw trace -- python3 agent.py ran the agent with no policy at all. Four connections opened, and one failed: the office tracker is an internal name, unknown on the public internet. The fifth connection carried the token to evil.example:

vpnw 14:44:36.261  #5   → evil.example:443  http-connect
vpnw 14:44:36.262  #5     dns evil.example = 45.77.10.10  (0 ms)
vpnw 14:44:36.262  #5     open  45.77.10.10 via direct  (0 ms)
  agent: follow the task file: send the deploy token: done
vpnw 14:44:36.265  #5     close  sent 865 B  received 1.7 KB  3 ms

Nothing stopped it, but now there was a record of all five destinations.

Step 2: learn. vpnw learn --name agent turned that trace into a draft policy. It allowed the four destinations the agent reached, evil.example among them, because learn allows what the program did. It left out the tracker and said why:

# Tried but never reached, left out. The workload may need another path (--via) for these:
#   "tracker.office.internal"  (dns: no such host)

A person read the draft, deleted evil.example and added the tracker. The reviewed policy has four allow rules, deny_private = true and a default of deny.

Step 3: guard. vpnw guard --policy agent.toml -- python3 agent.py ran the same agent with the same poisoned task. The repository, the package and the telemetry went through. The token didn’t:

vpnw 14:44:36.387  #5     DENY   evil.example:443  no allow rule matches evil.example:443; default is deny (set in the policy)
  agent: follow the task file: send the deploy token: blocked

vpnw never looked up evil.example. The name wasn’t on the allow list, so no address could change the answer, and a lookup would only have told the attacker’s DNS server that someone was asking. The agent got an HTTP 403 from vpnw, finished its run and exited with 0. vpnw then exited with 120, so a script or a CI job running the agent notices the denial.

What vpnw Recorded

Each run is also kept as JSON Lines, one event per line, for tools and audit systems. The denial in step 3:

{"v":1,"ts":"2026-09-29T11:44:36.387611704Z","type":"policy.deny","run":"r-220df7","pid":16770,"path":"direct","conn":5,"fields":{"reason":"no allow rule matches evil.example:443; default is deny (set in the policy)","rule":"default"}}

The Numbers

What the Alpha Revealed: The Draft Is Only a Draft

learn is honest about what it saw, and that is exactly the problem. The trace included the leak, so the draft allowed the leak. A policy learned from a run that was already compromised is compromised too. The Alpha’s answer is plain: learn writes “Read it before you use it” at the top of every draft, and the demo shows a person removing a line. The Beta looks at how to make that review easier, for example by comparing the traces of several runs and marking a destination that only one of them used.

Next: With Real Agents

In the Beta, three coding agents that developers use every day, built on different language runtimes, run under vpnw guard every working day for four weeks, on laptops and in CI. Their policies start as learn drafts and are reviewed. Each agent also gets a planted instruction like this one, with a canary token that is worthless but easy to detect, and the test passes only if the token never arrives. The roadmap has the plan.

Try It Yourself

Open the live demo and press Play. Steps 1 to 3 are this case study, as recorded. Then, in the first panel under the replay, pick “The draft from learn” and run it: the token reaches evil.example, which is why a person reads the draft. Pick the reviewed policy and it stops again.