(a) One agent run, traced step by step. (b) A workflow task.
Prompt-injection defense
Untrusted content reaches the main agent only as checked answers.
A verified quote shows where an answer came from, not that it is harmless. The other layers assume the agent can still be misled:
Sandbox. A throwaway container with a read-only root, no Linux capabilities and no network except the gateway, which allows only the task's tools.
Tools. A separate unprivileged user with network limited by Landlock. A broker checks every container against what the tool declared.
Shell. Each command is dry-run first under Landlock and seccomp. Side-effect-free commands then run read-only; the rest need my approval.
Outbound. Replies go only to me. Email recipients come from a fixed list, and links must come from the run's sources. Outgoing data is scanned for credential values, and the browser checks where each address it opens came from.
Approval. Browser submissions, uploads, personal details and every note edit need my approval. Passwords are filled from a card the model never sees.
Data. Credentials never enter the sandbox. Downloads are marked untrusted and only isolated readers may open them. Memory is scanned for injection phrases, hidden Unicode and secrets.
One job at a time
The Spark runs one large model at a time, and switching models takes minutes. Long requests become background tasks, so the chat stays free.
Self-extension
Every proposal needs my approval, and the builder cannot modify platform code, the isolated subagents or other locked tools.
