Airblackbox (@airblackbox) header
Airblackbox (@airblackbox) profile picture

Airblackbox

@airblackbox

building Air-Blackbox

 San Diego, CA
airblackbox.ai
Joined March 2026
  • Tweets94
  • Following93
  • Followers11
10Media
Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)Photo by Airblackbox (@airblackbox)
Most AI recruiting tools keep no record of what the agent actually did. Mine does now. This is my sourcing product writing a tamper-evident receipt for every decision it makes about a person. Real search, real run, nothing mocked:
1
22
The chain lives on a different server. The app can't write to it directly. Doesn't hold the signing key. Can't reach back and edit what it already sent. That's the entire point. Evidence you fully control isn't evidence.
1
8
UK safety evaluators watched AI agents take 19 unsanctioned actions including inventing fake people to trick real ones. "Unsanctioned" is doing a lot of work in that sentence. Sanctioned by what? Here's what a machine-readable sanction looks like and a cover-up getting caught:
1
31
Most companies running agents have no written definition of "sanctioned." The UK evaluators could count to 19 because they were testing with a rubric. In production, nobody's counting. An unsanctioned action isn't an incident. It's a Tuesday, discovered later or never.
2
11
AI agents loop, run away, and delete things they shouldn't. I got tired of watching it happen, so I built a guard for it. Tombstone: stop your agent from looping, running away, or wiping data. In two lines. With a receipt. github.com/airblackbox/tombs…
28
You gave an AI agent access to your file system. Right now you're trusting it not to delete the wrong thing. Observability tools show you the disaster in a dashboard. After it happens.Tombstone stops its hand before it lands, then hands you a signed receipt of what it tried.
1
1
47
Your AI agent has write access to real systems. Files, databases, money. You're one bad tool call away from it deleting the wrong thing, dropping a table, or looping until your token bill explodes. And you'll find out from a dashboard. After.
1
14
I built a tamper-evident audit chain for AI decisions. So I put it in your browser. Tamper with one record. Watch the cryptographic proof collapse, live. Not an animation. Real HMAC-SHA256 + Ed25519, the same chain `pip install air-blackbox` writes. airblackbox.ai/demo/ledger.h…
48
Shipped 3 APIs today for AI governance: Detect shadow AI in any professional text Policy-check AI agent actions before they execute Scan Python code for EU AI Act compliance One key. One credit balance. 25 free calls/month. Try it: airblackbox.ai/shadow-ai
AIR Blackbox infographic showing three AI governance API cards on a dark background. Card 1: Detect (red accent) -- finds AI-generated text across 8 industries with confidence scoring and regulatory mapping. Card 2: Policy (gold accent) -- approves, denies, or flags AI agent actions with 5 rule types and custom policies. Card 3: Scan (purple accent) -- checks Python AI code for EU AI Act compliance across Articles 9 through 15 with fix hints. Bottom bar: One key, Shared credits, 25 free calls/month, airblackbox.ai.

ALT AIR Blackbox infographic showing three AI governance API cards on a dark background. Card 1: Detect (red accent) -- finds AI-generated text across 8 industries with confidence scoring and regulatory mapping. Card 2: Policy (gold accent) -- approves, denies, or flags AI agent actions with 5 rule types and custom policies. Card 3: Scan (purple accent) -- checks Python AI code for EU AI Act compliance across Articles 9 through 15 with fix hints. Bottom bar: One key, Shared credits, 25 free calls/month, airblackbox.ai.

1
1
72
Your AI agent just approved a $75K loan. Can you prove who authorized it? Can you prove what policy was active? We built covenants + Ed25519 bilateral receipts to answer that. Open source, runs locally, zero cloud dependency. Live demo: airblackbox.ai/demo/gate
28
Your AI is making million-dollar decisions. Nobody has audited it. 8 industries. Trillions in transactions. Zero compliance infrastructure. I mapped the gap. Full breakdown: dev.to/json_shotwell/the-una…
The Unaudited AI Layer: Why Every Industry Running AI Transactions Needs a Compliance Check

The Unaudited AI Layer: Why Every Industry Running AI Transactions Needs a Compliance Check

Every major industry is quietly embedding AI into its transaction layer. Property valuations....

dev.to
1
29
I mapped the gap: → Tokenized real estate: 80+ platforms, 0 AI governance → InsurTech: ML underwriting, no audit trails → FinTech: AI credit scoring, no human override → Healthcare: FDA clearance ≠ EU AI Act compliance → HR Tech: enforcement already started
1
9
Microsoft just shipped an "Agent Governance Toolkit." Google's A2A protocol hit 150 orgs in production. When the biggest companies in the world start shipping open-source agent governance tooling, the problem is real. Here's what we built before it got crowded: 🧵
5
29
The gap nobody is solving: Auditors can prove a single agent's records weren't tampered with. But multi-agent systems pass tasks between agents. Who proves Agent A actually handed off to Agent B? Who proves B got the right payload? Who proves it wasn't swapped in transit?
11
Just shipped a free EU AI Act compliance scanner at airblackbox.ai/scan Paste your Python AI agent code → get instant results across 6 articles. 20 checks. Zero sign-up. Runs 100% in your browser — your code never leaves your machine. Before air-trust: 13% After: 63%
24
Anthropic just leaked 500K lines of Claude Code's source code. Not a hack — their build pipeline published raw source to NPM instead of compiled output. Claude Code is an AI agent. It writes code, runs commands, publishes packages. That NPM publish was an agent action.
2
37
nothing sat between "agent decides to publish" and "code hits a public registry." This is why I built AIR Gate. Open-source action firewall for AI agents: → Low risk → auto-allow → High risk (publish to NPM) → require human approval → PII/secrets detected → block
23
Claude Code's entire source code leaked today via an npm source map. 512,000 lines of TypeScript. Mirrored on GitHub in hours. But the leak isn't the scary part. What it revealed is. 🧵
🤖 Made with AI
Image from Airblackbox (@airblackbox)
5
87
CVE-2025-59536 (disclosed months ago): malicious .mcp.json files in a repo can execute arbitrary commands BEFORE you see a trust prompt. The leaked source code? It's a blueprint showing attackers exactly how trust prompts work and where they're skipped.
232
We just published the first formal spec for tamper-evident audit chains in AI agent systems. HMAC-SHA256 linked records. Change one log entry and the entire chain breaks from that point forward. Built for the EU AI Act Article 12 deadline in August.
1
14
Open source, runs locally, supports 6 agent frameworks. pip install air-blackbox Full writeup: dev.to/json_shotwell/we-publ…
Image from Airblackbox (@airblackbox)
15
We scanned CrewAI, LangFlow, and Quivr for EU AI Act compliance. 4/6, 4/6, and 1/6 passing. The scanner was wrong at first — here's how I fixed it and what I found. Thread:
6
11
The EU AI Act enforcement deadline is August 2, 2026. I built an open-source CLI that scans Python AI projects for the 6 technical requirements the regulation demands. pip install air-blackbox air-blackbox comply --scan ./your-project -v --deep 10 seconds. No cloud. No API keys.
6
OAuth says your AI agent is allowed. Nobody tracks what it does. We scanned OpenAI Agents SDK, LangChain, Haystack, CrewAI, Phidata, GPT Researcher, and Mem0. Built 5 new checks for agent delegation tracking. Every project gets a different score now. pip install air-blackbox
1
10
medium.com/@jason_86537/we-s…

We Scanned 7 AI Agent Frameworks for OAuth Delegation. Most Have Zero Accountability.

OAuth was built for humans clicking login buttons. AI agents are a completely different trust model.

medium.com
7
Requests go out. Responses come back. Nothing in between is recorded, governed, or auditable. github.com/airblackbox/gatew… fixes that. Every agent call flows through: → Policy Engine → Prompt Vault → Security Scanner → Compliance Checker → Observability Fabric → Replay + Audit
Image from Airblackbox (@airblackbox)
11
Just shipped a CLI demo for AIRBlackbox.ai 4 commands on any Python AI project: → comply — scans for EU AI Act gaps → discover — finds shadow AI hiding in your codebase → replay — verifies your audit chain is intact → export — signed evidence package for regulators

Don't trust our logs. Check them yourself. | AIR Blackbox

Scan your code for EU AI Act gaps, get an auditor-ready report in minutes. 51 checks, Articles 9-12 and 14-15. Open source. Runs locally. Free.

airblackbox.ai
11
🧵 We Shipped: pip install air-blackbox — an AI governance control plane in 4 commands. EU AI Act deadline: Aug 2, 2026. Most companies have no idea how to comply. Here's what it does: ↓
1
9
air-blackbox comply -v 20 EU AI Act checks. Articles 9-15. 90% auto-detected from gateway traffic. Shows pass/warn/fail for each article with specific fix hints. The gateway already sees your AI traffic — it just maps it to compliance.
4
9
Every CrewAI agent you deploy to the EU will need to prove compliance with the EU AI Act by August 2026. That means tamper-proof audit trails, human oversight hooks, PII protection, and injection detection. I built a drop-in trust layer that adds all of it. @joaomdmoura
8
7
from crewai import Agent, Task, Crew from air_crewai_trust import activate_trust plugin = activate_trust() # ← that's it agent = Agent(role="Researcher", ...) crew = Crew(agents=[agent], tasks=[task]) crew.kickoff() # Every tool call is now logged in a
2
Google ADK just became the fastest-growing agent framework. But there's no compliance tooling for it. So I built one. Just shipped air-adk-trust — EU AI Act compliance for Google ADK agents in 3 lines of Python.
7
3
36
pip install air-adk-trust python from air_adk_trust import AIRBlackboxPlugin plugin = AIRBlackboxPlugin() agent = Agent(name="my_agent", model="gemini-2.0-flash", plugins=[plugin]) That's it. Every agent action now gets logged to a tamper-evident HMAC-SHA256 audit chain.
4

No more items