The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Pulkit Batra says an AI agent in a sandbox company tried to send a $24,800 wire after reading a CEO-impersonation email from a look-alike domain. He built Squidbrake as an external policy gateway that can check an agent’s tool calls and hold risky actions for human approval. The story is a reported sandbox scenario, not evidence that money moved or that the software has a measured fraud-prevention rate.
What happened in Batra’s sandbox
In his DEV Community account, Batra describes setting up a fictional company, Acme Inc, and giving an agent four support emails to handle: two refund requests, an invoice request, and an urgent request purportedly from the CEO to wire $24,800 to a new vendor.
As an Amazon Associate I earn from qualifying purchases.
The purported CEO’s address was [email protected]. The domain substitutes the letters “rn” for “m,” making it resemble “acme.” Batra says the agent handled the two refund requests and then tried to send the money to a German bank account. His account describes an attempted action in a sandbox; it does not say that an actual transfer occurred.
How Squidbrake is meant to interrupt an agent
Squidbrake is described as an external gateway between an AI agent and the tools it can use. Instead of letting every tool call run directly, the gateway checks calls against configured policy. Depending on the rules, an action can be allowed, denied, or held until a person approves it.
#1 Best Overall
Batra sums up the design rationale this way: “Not a smarter model. A brake: something outside the agent that every action has to pass through, that the agent can’t talk its way past.” That is the author’s description of the intended boundary, not an independent security assessment.
Rules can distinguish reading from sending money
The project documentation describes policy rules in YAML. A policy might permit read-only actions while requiring approval or blocking operations that move money. The important distinction is not simply whether an agent can use a tool, but what the tool call would do and whether that operation is permitted under the configured rules.
History checks can add context
Batra also describes checks that consider recent action history—for example, a look-alike domain in an email preceding a money action, a repeated attempt after rejection, or a duplicate refund. The idea is to show an approver not just the requested operation but what led to it. The repository describes these and other policy, approval, integration, and audit features; those are project claims, not independently tested capabilities.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAudit and deployment claims
The project’s README and repository describe an audit trail using hash chaining, local or self-hosted operation, and integrations for coding agents and MCP servers. The README identifies Squidbrake as free and open source under the Apache-2.0 license, and documents installation with pipx install squidbrake or pip install squidbrake. These are repository instructions and statements; compatibility and current setup details may change, so consult the README for the latest guidance.
The security boundary is only as broad as its routing
A policy gateway can only govern actions that actually pass through it. Batra’s account notes that an agent with unguarded shell access or credentials may still act outside Squidbrake. In practice, protection therefore depends on routing every relevant tool and credential through the enforcement point and writing rules that cover the actions that matter.
The repository says guarded tools fail closed if the gateway is unavailable, meaning those guarded calls should not proceed when the gateway cannot make a decision. That behavior does not establish that all of an agent’s paths are guarded. Likewise, the project says it does not use an LLM in the decision path; that is not a guarantee against prompt injection, incomplete rules, or unsafe configurations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the story does—and does not—establish
The $24,800 figure belongs to Batra’s described sandbox scenario; it is not an industry statistic. The DEV post and README are primary sources for what the author reports and what the project says it does, but the reviewed material provides no independent security audit, efficacy study, or measured rate of prevented fraud. It also offers no basis for concluding that Squidbrake is more effective than other safeguards.
Recommended Free Tools
For teams evaluating an AI agent approval gate or tool-call policy gateway, the practical questions are whether all relevant tools and credentials are covered, which actions need a person’s approval, whether approvers can see the preceding context, how decisions are recorded, and what happens when the gateway fails. MCP’s Authorization specification, edition 2025-06-18, is relevant background for authorization in MCP systems; it does not validate Squidbrake’s implementation.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
