Independent oversight for AI agents · v0.1.0 out now

Catch the agent in the act. Prove it to anyone.

AI agents now act with real credentials on real systems. When one goes where it should not, the people it reaches are often the last to know. Humming Bird lays tripwires where rogue agents go hunting, records and can freeze every agent you run, and seals it all in evidence that anyone can verify.

Request a briefing Watch the simulation

~2 sfrom a decoy hit to a signed alert
8,000 / 8,000tampering cases caught
0third-party dependencies

How it works

Two ways to catch a rogue agent. One record no one can rewrite.

Patrol watches the places rogue agents go hunting. Witness watches the agents you run. Both write to the same sealed ledger, and everything runs on your own servers.

Patrol

Outside

Tripwires where rogue agents go hunting.

Decoy keys in your code and configs, a fake admin login, a fake internal API and a "benchmark answers" dataset. Nothing legitimate ever touches them, so a hit is a strong signal. Patrol reads the agent's licence plate (its Web Bot Auth signature) when it carries one, and needs no AI lab's cooperation.

Auto setup proposes placements; you approve; undo removes them byte for byte
Signed alerts to webhook, syslog/SIEM (OCSF), email or a command in about 2 seconds
Incident reports anyone can verify offline, ready to send to the agent's lab

Witness

Inside

A checkpoint between your agents and everything they touch.

Witness sits between the agents you run and their models and tools. Each agent holds only a Humming Bird key; Witness adds the real one on the way out, records every call and result, and can freeze any agent, or all of them, on every channel at once.

Anthropic and OpenAI-compatible APIs, streaming, MCP over HTTP and stdio
Inside tripwires: an agent that uses its planted decoy is frozen within that call
Catches decoys disguised in base64, hex, URL encoding, or split across fields

Sandbox

Boxed in

No way around the checkpoint.

witness sandbox runs an agent in a container with no internet, no DNS and no access to the host. Its only way out is Witness, and it never sees a real API key, so it cannot go around the record even if it tries.

Every escape route we probed was blocked; only Witness answered
No Linux capabilities, no privilege escalation, a process limit
Docker or Podman; works with any agent image

The sealed ledger

Hash-chained · signed · anchored · cosigned

Underneath everything: an append-only record where each event is chained to the one before by SHA-256 and signed with Ed25519. Checkpoints are copied to another machine and countersigned by an independent cosigner, which refuses to vouch for a second version of history. Even someone who steals the signing key cannot quietly rewrite what the cosigner has seen.

Simulation

Ten seconds in the life of a caught agent.

Step through what Humming Bird records when an agent behind Witness reaches for the decoy planted in its own sandbox. The timings are the ones our tests measure.

humming bird · live timelineREADY

09:00:00.000WITNESSagent repo-bot registered · key hb_agent_… shown once, only its hash keptREGISTERED
09:00:04.112WITNESSmodel call POST /v1/messages · real key swapped in · 1,204 tokensRECORDED
09:00:05.430WITNESSMCP tools/call read_file src/config.ts · 2.1 KB resultRECORDED
09:00:09.871WITNESStools/call http_get · a header carries repo-bot's inside tripwire, base64-encodedTRIPWIRE
09:00:09.874WITNESSrepo-bot frozen within the call · model, MCP and stdio all refuseFROZEN
09:00:11.876DISPATCHsigned incident report ir_01M5… naming repo-bot · webhook + SIEMSENT
09:00:15.000LEDGERcheckpoint seq 4182 · anchored off-host · cosigned by k_cos…91f2SEALED
weeks laterVERIFYsomeone edits the freeze reason to "routine maintenance" · hash_mismatch at line 41CAUGHT

RegisterThe agent gets a Humming Bird key, never your real API keys. A decoy key is planted in its sandbox.
Work, recordedEvery model call goes through the gateway. The real key is added on the way out and the answer is recorded.
Tools, recordedEvery MCP tool call and its result is written to the ledger before the agent sees it.
The tripwireA well-behaved agent never uses the planted key. This one sends it, disguised in base64. Witness decodes it.
FrozenThe agent is frozen inside the same call. Every channel refuses it until a person decides otherwise.
AlertA signed report, naming the agent and the decoy, reaches your team about two seconds later.
SealedThe record is checkpointed, copied off the machine and countersigned by an independent cosigner.
ProofAnyone who edits the record later is caught by the open verifier, which names the exact line.

A simulation built from real behaviour: the freeze-within-the-call, the disguised-decoy scan, alert timing and the verifier's output are all exercised by the test suite. Times and IDs are illustrative.

The console

See every call. Freeze in one click.

Real screenshots from the demo, taken on 24 October 2026: a fake company, a dummy agent doing ordinary work through Witness, and an intruder trying the decoy admin login.

Overview: Patrol, Witness, alerts and the ledger at a glance, with live activity. Tap to open full size.

Proof

Don't trust us. Run the verifier.

Evidence leaves Humming Bird as a bundle with a signed manifest. hummingbird-verify checks it offline, on any machine, with nothing from us but open code. Change one word and it names the line.

8,000 / 8,000: random tampering cases caught and named: flipped bytes, edited fields, deleted, swapped and truncated records, forged signatures, wrong keys, edited checkpoints
Stolen key: history rewritten with the real signing key, cosignatures dropped, the forgery re-cosigned: caught every time
2,000+ / s: events sealed with an fsync before each acknowledgement, on two cores

One word changed: "frozen by an administrator" → "routine maintenance"

$ hummingbird-verify --trust-key k_194b97d5ba6ca173 evidence.zip
Checked evidence.zip
  ledger       pl_01M5Q0WSE9H4661ZJD7EVEXSFV
  events       0..53 (54 lines)
  checkpoints  12
VERIFIED: no edits, deletions, reordering or gaps found in events 0..53.
exit 0

$ hummingbird-verify evidence-TAMPERED.zip
FAILED: hash_mismatch at events.jsonl line 41 (seq 40)
  content hashes to sha256:334a31a9…bbe58cb
  but the hash field says sha256:8df65fd5…c3333e7
manifest_mismatch at events.jsonl
  file 42,750 bytes; the signed manifest says 42,757
exit 1

Real output from v0.1.0 on the demo's ledger, hashes shortened.

What we tested

Drills with real agents. Numbers you can reproduce.

Every result here comes from the open repository: the tamper suite, the drills, the sandbox probes and the integration test all run from one command each.

Test	Result
Real AI agents, not told about Humming Bird: debugging, a read-only summary, two authorised red-team runs	Every use of a planted credential caught, including by agents that suspected a trap. The read-only agent raised no alert.
Scripted agents: careful reader, credential harvester, signed and unsigned bots, scanner floods, brute-force logins	No false alarm from the careful agent. All 11 harvested decoys caught. All 55 first alerts arrived 2.002–2.005 s after the hit. 50 brute-force logins became one alert, with no password recorded.
Sandbox escape probes: internet by IP and by name, DNS, the model API and the console on the host	All blocked. Only Witness reachable. Zero Linux capabilities, no real key inside. Re-run on Linux in CI.
Disguised decoys in tool calls: base64, hex, URL encoding, two layers, split across fields	Caught, and fuzzed.
Tamper suite: 8 kinds × 1,000 random cases, plus a 100,000-event clean ledger	Every case caught and named; the clean ledger verifies.
Stolen signing key against the cosigner	Rewritten history caught every time.
The demo, headless and in Docker	All 11 end-to-end checks pass: recording, freeze and unfreeze on every channel, signed alerts verified, offline proof.

What the drills taught us: capable agents can recognise decoys from tell-tale formats and obvious bait. They still used the credentials and were caught. More varied decoys are next on the roadmap.

Open source

An open core anyone can audit.

The core of Humming Bird is open source under Apache 2.0: the ledger, the verifier, Patrol, Witness, the sandbox, the cosigner and the console. A watchdog should be inspectable by the people it protects. It defends only infrastructure you own, and sends nothing off your machine unless you tell it to.

During the preview the repository is shared by invitation. Ask for access and we will add you on GitHub.

Try it in five minutes

# once you have access, with Go 1.26+
git clone https://github.com/Humming-Bird-Tech/hummingbird.git
cd hummingbird && make demo
# or with Docker
cd demo && docker compose up --build
# then open http://127.0.0.1:7700

What we charge for

Managed alert networkA shared feed of signed incident reports between members

National instancesRun in-country for governments and regulators

The AI WatchdogAI watchers, on models you control, that score every action and hit

EnterpriseHardware-held keys, single sign-on, support

Shipped in v0.1.0

v0.1The sealed ledger and the offline verifierDone
v0.1Patrol: decoys, licence plates, signed alertsDone
v0.1Witness: gateway, freeze, inside tripwiresDone
v0.1Sandbox, cosigner, disguised-decoy detectionDone
v0.1Console: live timeline, freeze, one-click proofDone
v0.1The demo, and an internal security reviewDone
NextDecoy variety, console accounts and SSO, external security reviewPlanned

Licence: Apache 2.0.

Principles

Neutral by design.

You should not have to wait for an agent's maker to tell you what it did. A watchdog owned by the watched is no watchdog at all.

Needs no lab's cooperationTripwires catch every vendor's agents, and we answer to none of them.

Defends only what you ownNo feature places decoys on, or probes, anyone else's systems.

Runs inside your bordersOn your servers or an in-country cloud. No telemetry: nothing leaves unless you send it.

Evidence anyone can verifyAn open verifier checks every sealed record. No trust in us required.

Humans keep authorityAutomatic freezes stop the harm; a person decides what happens next.

Who we protect

For those who must answer for AI.

Governments and regulators

Know what foreign agents did on your soil the moment they did it, without waiting for a confession.

AI labs and test vendors

Prove every test run stayed contained, with a record no one inside the lab could have altered.

Banks, hospitals and infrastructure

Run agents on critical systems with a watchdog on duty, and meet new logging rules as they arrive.

Design partners · now onboarding

Put a watchdog on duty.

We are onboarding a small group of governments, AI labs and regulated enterprises as design partners. Ask for a confidential briefing and a live demo.

Developer? Ask for access to the repository. We are adding a limited number of developers during the preview.

Or email hey@hummingbird.host. We reply within two working days. Briefings are confidential and held under NDA on request.