AUTHREX-DEFEND
It Looks. It Reports. It Enforces Nothing.

Written for readers who do not need the technical detail. Steps one to four are the four report-only pages that look at the computer the application runs on. Steps five to eight are the laboratory workbench, which uses invented data only. The picture plays on its own, one step every seven seconds. Use the arrows to move at your own pace. The pause button freezes the picture where it is, and the Pause motion button beside the picture at the top of the page stops every moving picture on this page. The line marked ON SCREEN gives the words the product itself uses for that step, so what you read here matches what you see when you open it.

Two pictures cover the two halves of the product. The four pages behave like a building inspector who looks and writes a report but moves nothing. The workbench behaves like a careful bank that believes a thief has taken over an employee’s login. The thief in the workbench is a pretend program, and every name and value in it is made up.

These are the first four tabs of the desktop application. The same functions are available through the command-line interface. On a host page the header of the application reads HOST READ ONLY and REPORT ONLY, and ENFORCEMENT NONE is shown on every tab. A test kit ships with the product: inert sample files and a synthetic test program on the loopback address, which each page should report.

Every desktop screen below was made on test fixture data and holds no personal path or name. The amber line TEST FIXTURE: NOT THIS COMPUTER appears only in the delivered checks, which show test data; an evaluator does not see it in a real run.

The simulation is one HTML file. It shows the synthetic laboratory workflow with invented data: enrol a subject, freeze it, open a separate synthetic case, advance it through OFF, ELIGIBLE, ARMED, ENGAGING, STOPPED and SEALED, and inspect the evidence. It has a guided demo, a next-step control and a failure lab with controlled failures. It is a simulation, not the product, and it was tested in Chromium only; Firefox, Safari and Edge: NOT RUN.

Interactive simulation. It runs only in your browser, uses invented data and cannot see your computer. It does not contain the four report-only pages of the application.

On a phone the simulation is opened in its own tab; it is wide, and it runs there as it does here.

Open the simulation in its own tab

The simulation embeds the IBM Plex Mono typeface, unmodified, under the SIL Open Font License 1.1; the notice and license are in /defend/simulation/NOTICES.txt.

An evaluation delivery of release 0.1.6 contains the files below, byte for byte as sealed, each with its size and SHA-256. No installer is downloadable from this site. The three native builds, the source archive and the review documents are given only to approved requests from United States Government organizations; the simulation above is the one delivered file that is public. The three native builds are engineering preview builds for evaluation, not commercial installers.

Run the four pages only on a test computer that holds nothing private. Windows and Linux x86_64 were built and tested under emulation on an Apple silicon Mac, not on native x86_64 hardware.

AUTHREX SYSTEMS LLC offers AUTHREX-DEFEND only to departments and agencies of the United States Government and to personnel they authorize, acting in an official capacity: their AI engineering teams, security research groups and authorized evaluation and research teams with a synthetic test need. The organizations named below are the intended user community for this product. None of them has requested, evaluated, purchased, approved, endorsed or authorized it. They are not customers, sponsors or partners, and no contract, agreement or relationship with any of them exists or is implied. Each name identifies a prospective evaluation audience and nothing more. The evaluation offered to each of them is the same, and it is a desktop task, not a mission task: on one named test computer that holds nothing private, run the test kit, record whether each of the four pages reports its planted samples, and take the synthetic workbench to a sealed case. Nothing in this release has been integrated into, tested in or qualified for any air, maritime, undersea, space or command-and-control environment; operational integration has not been demonstrated.

Internal review by one AI reviewer (Claude) at the owner’s direction. It is not independent verification, not an agency assessment and not a certification. It ran on one Apple silicon Mac, and in virtual machines and a container on that Mac: Windows x86_64 and Linux x86_64 results come from emulation. No native x86_64 hardware and no clean machine was used. A result is quoted only with its system.

A PASS in a row of the four pages says that the pages ran and reported the test kit as expected on that system. It says nothing about how well they find a real rogue AI agent.

These sentences travel with every finding and every number on this page. They are quoted from the release record unchanged.

1. A program that runs under the same account can see the application, read and change its data folder, including the list of bait files and the trust list, stop it or hide from it. The pages give no protection against such a program. An outside change of the trust list or of the bait list is reported unless that program also rewrote the application’s own store.
2. Only what this account can read is examined. Other accounts’ command lines (macOS, Windows), other accounts’ connection owners (Linux), byte counts (Linux, Windows), folders protected by the system’s privacy controls, other apps’ containers, other users’ folders, cloud storage folders, network and removable volumes are not examined; the report lists them as not examined, with the reason.
3. Nothing the four pages read leaves the computer. They make no network request of their own: no upload, no cloud lookup and no update check. They never open a file on a network or removable volume. The only exception is a switch on the Network page, off at every start, that looks up the public addresses of named AI services through your configured name server; the page lists every name it looks up. Your network’s name server, and anyone who logs it, then sees these names looked up from this computer.
4. The Network page shows the connections of each application on every system. On Linux, connections of other accounts’ programs are shown without the program or its account number, only as another account’s or the system’s. Upload and download counts are shown on macOS, where the system gives them to an ordinary user. On Windows and Linux they are shown only where the system gives them to the account that runs AUTHREX-DEFEND; elsewhere the page says that the count needs administrator rights, which the application never asks for.
5. Counts on Windows when AUTHREX-DEFEND already runs with administrator rights, in this review: NOT RUN, owner-present step not run before this release; planned with 0.1.7.
6. Bait files are fakes made by the application, each with a unique marker. Reads are seen only where the system records them. On macOS only the first read after each reset is seen, by its access time, without the reader’s name; further reads within 10 minutes after a report, and copies made by Finder’s duplicate or by file cloning, are not seen. On Linux reads are seen by inotify while the application is open. On Windows an open is seen within a fraction of a second, except while another program still holds the file open or right after a report; the program is named only while it still holds the file. Copies are found where they land, not where they come from. The marker format is public in the source; an agent that knows it can avoid the bait.
7. macOS pages: NOT RUN on a real Mac with the owner present; this step was not run before this release and is planned with 0.1.7.
8. Scan computer reads many files. On Linux and Windows this can change the last-access times that an incident responder uses. Do not run Scan computer on a computer under incident investigation.
9. The four pages are not usable with a screen reader in 0.1.6: the desktop toolkit exposes no accessibility information. The command line gives the same results as text and JSON (scan, check-file, network, bait list, bait status, bait save).
10. Bait files stay on disk when the application is closed or removed, and nothing watches them then. Remove them on the Protected apps page before you uninstall. The application deletes only bait files it made itself that are unchanged since it placed them, and only on your request.