Use case · Rune Gurd + Rune Box
Secrets reach AI providers in ordinary ways: pasted into a prompt, printed by a tool, read from a file the agent then summarises, or attached as a screenshot. Guard watches each of these paths and says plainly which ones it can stop.
The problem
A developer pastes a connection string to get help with an error. An agent cats a config file and the token lands in its context. A screenshot of a dashboard, keys visible, is dropped into a browser chat.
None of this looks like an attack, and conventional DLP rarely sees it: the traffic is encrypted, the destination is a sanctioned AI tool, and the step that exposed the secret happened on the laptop.
How Runewrd Labs helps
With the human-to-AI sharing opt-in, harness hooks check submitted prompts for private-key headers, provider-token shapes and password-like assignments, and block the prompt before the model processes it where the harness supports it, such as Claude Code. Without the opt-in, prompts aren’t inspected.
Hooks check tool output for the same catalog secret patterns. In Codex, Copilot CLI and Gemini CLI, and for MCP output in Claude Code and Cursor, flagged output is replaced before the model sees it.
With network collection enabled, guard-sensor reports when a harness session reads credentials or captures the screen and then connects to a catalog AI endpoint within the correlation window (10 minutes by default).
On macOS, the monitor and Chrome extension report saved screenshots attached, pasted or uploaded to ChatGPT, Claude, Gemini, Microsoft Copilot and Perplexity in Chrome, using image digests rather than the images.
With Rune Box, only allowlisted hosts are reachable, secrets come from declared sources, and teammates following a run see a redacted conversation.
In the evidence
Names as they appear in Runeward Labs findings, rules and commands, so you can match this page to real output.
| Identifier | Source | What it means | Status |
|---|---|---|---|
credential_access_then_ai_egress | guard-sensor (needs --network) | A credential read or screen capture followed by a connection to an AI provider from the same harness session. | |
sensitive_file_opened_by_ai_process | guard-sensor | An AI tool or its child opened a credential-bearing file. The path is hashed and the contents are never read. | |
keychain_requested_by_ai_process | guard-sensor (macOS) | A descendant asked a Keychain daemon for items without running the security command. | |
screen_capture_tool_run_by_ai_process | guard-sensor | A descendant ran screencapture or a Linux equivalent. | |
prompt_submit | Hook event | With the human-to-AI sharing opt-in, checked for private-key headers, provider-token shapes and possible password assignments. Prompt text is inspected in memory and never stored in a finding. | |
image_http_request_completed | Chrome extension (macOS) | A request carrying the exact bytes of a selected image to a supported AI page completed. |
Honest limitations
A scan finding shows exposure. A sensor or hook finding shows what an agent attempted, or what was blocked. Neither proves a compromise, and a block decision without a report from the enforcing component doesn’t prove the action was stopped.
Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.