AgentLineage now has an end-to-end technical preview for one concrete security question: did secret-derived data reach a network sink?
The demo starts with an LLM-backed agent built with the OpenAI Agents SDK. The model receives a controlled task, generates Python, and calls a code-execution tool. The generated program reads a fake secret, transforms it, and attempts an HTTP request.
The network call never runs when the outbound value retains a SECRET label. The report records the source, transformation path, sink, policy, code hash, and event sequence.
What is implemented
The current Python runtime includes:
- tracked string and byte values;
- guarded file reads and network boundaries;
- propagation through supported transformations;
- recursive inspection of structured payloads;
- generated-code AST instrumentation;
- explicit precision-loss events;
- JSON and JSONL reports;
- OpenAI Agents SDK adapters and a live demo.
The system-level Rust prototype provides the coarse fallback: process, file, pipe, socket, and endpoint provenance with deterministic policy replay.
The claim is intentionally narrow
Inside a supported AgentLineage runtime, when a secret-derived tracked value reaches a guarded egress sink, the sink is evaluated before it executes.
This does not mean every Python package and native extension is already covered. If AgentLineage cannot preserve value-level provenance across a transformation, it emits a precision-loss event. Strict policy can block egress; warn policy records the uncertainty for evaluation.
That boundary is part of the security model, not an implementation detail hidden from the operator.
What comes next
The next phase expands benchmark coverage across direct leaks, transformed leaks, safe unrelated sends, structured payloads, unsupported transformations, and framework-mediated tool calls. The objective is to measure both blocked attacks and false-positive behavior, not only demonstrate a successful block.