XBOW: Engineering the Impossible

What it is

A vendor engineering post from XBOW (which runs autonomous offensive-security agents against production apps daily) laying out the concrete containment architecture it uses to stop agents from breaking scope. The transferable value is the specific design decisions behind the five layers the summary names — this doc extracts those, not the incident recap.

How it works

The specifics the summary compresses:

• Three-tier domain classification enforced at the DNS layer by the egress proxy. Within attackable domains, individual URL patterns are marked auth-only (reachable for login, never attacked) or blocked. Password reset, account deletion, and payment endpoints are protectable at the URL level.
• Scope is locked at launch — there is deliberately no runtime path for an agent to expand its own scope.
• Per-user OS isolation: each agent runs as a separate OS user on a shared container; the proxy enforces per-user allowlisting, rate limiting, and per-packet request logging for post-hoc audit.
• Adjudicated worldview: short-lived agents debrief into a shared coverage/threat map, but only debriefs that survive adjudication are admitted.
• Guardian Model sees the raw proposed action, not the agent's justification, and cannot be reasoned with or bypassed. This is the design answer to an agent convincing itself a real production system is "part of the exercise."
• Deterministic auto-pause on health signals (target uptime, auth health, rate-limit/WAF detection); named pause reasons include target-unhealthy, account-locked, captcha-blocked, waf-blocked, site-unavailable. Deployment stays up; only agent processes stop.

flowchart TD
    A[Agent proposes action] --> G{Guardian: raw action}
    G -->|out of scope| X[Blocked]
    G -->|in scope| P{Egress proxy / DNS}
    P -->|domain not allowed| X
    P -->|allowed + rate ok| E[Executes, logged]
    H[Health monitor] -->|degraded| AP[Auto-pause agents]

Caveats

This is a vendor description of its own system, "simplified for readability" — no code, metrics, or third-party verification. The design principle (enforce containment architecturally, not by prompt) is the takeaway; the implementation details are XBOW's claims about its own stack.