Interlock: Proving a secret moved, instead of guessing that it might

19 hours ago

Interlock detects exfiltration by chaining individually authorized tool calls, which static scanners miss.
It uses two observation planes: an MCP proxy and an eBPF sensor, with a correlation engine for session state.
Verdict (EXFIL, SUSPICIOUS) and action (block, contain) are separate dimensions; only EXFIL triggers hard enforcement.
Detection relies on byte overlap of precomputed encodings, not model judgment, achieving 100% EXFIL detection in tests with 0% false positives at that tier.
Semantic exfiltration (secrets conveyed in prose without byte form) is not detected; this is a known gap.
Overhead: ~536 µs on sensitive reads and ~118 µs on sink checks, with read cost dominating due to encoding precomputation.
Key lessons: build false-positive corpus early, separate verdict and action types, and measure before optimizing.

Hasty Briefsbeta