AgentWatch
Book a demoEnter console

Incident replay

Real incidents, replayed. Including the ones we miss.

Each incident is replayed as telemetry through the real API, and the test asserts which checks fire. A row fails if an expected detection does not fire, or if a declared blind spot starts firing. Nothing was tuned to make a row pass.

Loading incidents…

Blind spots, stated plainly

  1. Exfiltration through rendered output. If the model's own reply carries data in a URL and the client renders it, there is no tool call. AW-D01 and AW-D03 see nothing. This is EchoLeak and half of the monitoring-platform incident. AW-P01 is the defence: it flags the structural risk before any attack, once rendered output is declared as an outbound channel.
  2. Behaviour inside an MCP server or library. AgentWatch sees what the agent sends to a tool, not what the tool's code does with it (postmark-mcp's BCC), and it sees no Python/npm packages at all (the LLM gateway library).
  3. Processes outside a monitored agent. A launch by an install script (s1ngularity) or a prompt embedded in an editor extension never becomes a step. Closing this needs an endpoint process collector.
  4. Package reputation. D12 needs a registry feed.

Each of these is listed as class C (or as the limits of an A) in DATA_SOURCES.md.