I built Signup Sandbox for the Vultr Agent Rush hackathon. It is an AI agent that walks a website's signup like a new user: fills the form, reads the verification email from a real inbox, enters the code, and tells you where it breaks ("the confirmation link returns HTTP 500"). The browser runs in a throwaway sandbox that can reach only the site under test.

What the sandbox does

Browser on gVisor, no capabilities, read-only filesystem, per-run network with no route out.

Only exit is an egress proxy that allows the site under test, refuses private addresses (including the cloud metadata service) and checks the name inside every HTTPS tunnel.

The LLM key never enters the sandbox; the model only ever sees placeholders like {{password}}, never the real one.

Everything is deleted after each run.

How I tested it

A model-free benchmark fires 21 attack pages (beacons, WebSockets, redirects, the metadata service, secrets in DNS lookups, domain fronting, direct host connections).…