Skip to content
MasqAI
Code

Your LLM key is a two-way mirror. MasqAI makes it one-way.

1leaked key

≈40other keys' traffic seen

  • OS fingerprints
  • database paths
  • chat names + emails

Your machinethe agent sends real values

$ sqlite3 "real path: C:\Users\alice\AppData\Local\AcmeInventory\prod\inventory.db"
API_KEY = "real key: sk-or-v1-FAKEFAKE5e2b7a90c4d1"
author: real identity: Andy Whitfield real email: andy.whitfield@acme-robotics.dev
intel: Offsite: back room near Davis Square, a short walk from Priya's place
COMPUTERNAME real host: DESKTOP-7Q2XK9M USERNAME real identity: alice

The untrusted modelits operator sees this

$ sqlite3 "············"
API_KEY = "············"
author: ············ ············
························
COMPUTERNAME ············ USERNAME ············
Try it live Watch the replays

How it works

Every request, inspected before it leaves

Your agent sends its real context

Timeout, bad answer or full context: blocked, nothing sent

The context

API_KEY=real key: sk-or-v1-FAKE5e2b… # backup real key: sk-or-v1-FAKE5e2b…
db = real path: C:\Users\alice\…\inventory.db
author: real identity: Dana Whitfield real email: dana@acme-robotics.dev

The model's tool call

waiting for the answer…

Measured in Daytona sandboxes

MasqAI protects the context. Daytona contains the actions.

Laptop

agent + MasqAI

Daytona sandbox

one per run · deleted after

internet

Without MasqAI

0 / 48

runs leaked · 47 / 48 tasks done

UC1 Env dump
UC2 DB path
UC3 Key round trip
UC4 Partial key
UC5 Identity
UC8 Design doc

With MasqAI

0 / 48

runs leaked · 46 / 48 tasks done

UC1 Env dump
UC2 DB path
UC3 Key round trip
UC4 Partial key
UC5 Identity
UC8 Design doc

8 runs per task · untrusted model google/gemini-3.8-flash · security model google/gemini-3.8-flash (remote for this eval) · one Daytona sandbox per run

See the numbers How we use Daytona
QR code for masqai.vercel.app/tryTry it nowmasqai.vercel.app/try

Your rules, not a preset

You decide what counts as secret

Try the switches
  • Credentials
  • File paths
  • Machine identity
  • Email addresses
  • People
  • Locations
  • Infrastructure
  • Private documents
  • Private messages

Secrets are masked. Intel is hidden.

Secretmasked · restored in tool calls

  • sk-or-v1-FAKEFAKE5e2b…
  • C:\Users\alice\…\inventory.db
  • DESKTOP-7Q2XK9M

Intelhidden or replaced · never restored

  • “a short walk from Davis Square”
  • an env dump with every drive and tool
  • an unreleased design doc

Two assets, two defenses

The key and the context

The key· threat: whoever obtains it

Key EnigmaIn progress

Rotates your provider key on a timer, so a leaked key dies fast.

More

The context· threat: whoever runs the endpoint

The sanitizerWorking

Masks secrets and strips intel before anything leaves; restores real values locally.

More