Superinspect · The flight recorder for AI agents

Incident, audit or investigation:

What counts is what the agent actually did.

The final answer alone rarely settles it. Every step in between has to be on record.

Incident response

Reconstruct how the agent was compromised: which input reached it, which tools it called, what left the system.

Internal audit

Evidence for each finding: what happened, in a record whose integrity can be checked.

Digital forensics

Show what triggered which action, step by step, from the first prompt to the last tool call.

41.7% missed by output-only audits

Privacy violations in multi-agent LLM systems, measured across 4,979 execution traces.

Source: AgentLeak benchmark, El Yagoubi et al., arXiv:2602.11510

The gap is between the agents.

Part of the leakage happens in internal channels between agents, which a check of the final output never sees. Superinspect records those internal channels too.

Observes the agent, never steers it.

Record. Seal. Report.

Each step leaves something you can check: the event, the chain, the finding.

Step 1

Record

Prompts, retrieved content, tool calls, memory operations and model responses are captured at runtime.

Step 2

Seal

The record is append-only and hash-chained. Signed checkpoints are written to a separate location, and the keys stay with you. Tampering before the latest signed checkpoint is detected.

Step 3

Report

Each finding, such as prompt injection, personal data or a policy violation, points to the exact recorded event and to a named requirement in the EU AI Act, ISO/IEC 42001, NIST AI RMF or the OWASP Top 10 for LLM Applications.

Measured, not promised.

Four measurements, each with its scope.

Prototype results on public benchmarks and in a test setup. The note under each number belongs to it.

35 of 35prompt-injection attacks detected, 0 false alarms on 126 benign textsDetection of prompt injection in agent inputs. Heuristic detector, one attack template.AgentDojo benchmark

6 of 6internal agent channels: personal data foundDetection in internal channels between agents. Small sample.AgentLeak benchmark

0.03 msRecording overhead: median per call (0.02 ms without)Median time per call with and without recording. Test setup, machine-dependent.Superinspect test setup

4,000 of 4,000events written with 8 parallel processes, chain verifiedWriting under load, chain checked afterwards. Under overload, drops are counted as evidence.Superinspect load test

All three have their place.

Why not platform logs, observability or guardrails?

Superinspect adds independent, auditable evidence.

vs platform logs

Across vendors, on your network, with your keys

Built for the vendor's own operations. They usually cover only that one vendor, and the vendor holds the data.

vs observability

Every event hash-chained, every finding mapped

Built for debugging and performance, not as a tamper-evident chain of evidence, and not organised around audit requirements.

vs guardrails

Records only, never intervenes

They block or change requests, which changes the very flow you may later need to evidence. Superinspect can run alongside them.

Its own attack surface, kept small.

Built for a security review.

Six properties your security team can check before a pilot.

Observe-only, fail-open

Never blocks or changes a call. If recording fails, the application keeps running and the gap is counted.

Read-only on your data

Your data stores are opened read‑only. A write attempt fails at the database itself.

Owner-only evidence

Evidence files, including their side files, are created readable by their owner only.

Never the value

Findings store what was found and where, never a copy of the sensitive value.

Local dashboard

Binds to localhost by default. It loads no JavaScript and nothing from outside.

Pinned dependencies

Hash-locked, scanned for known vulnerabilities, adopted only after a 14‑day waiting period.

The security model is documented alongside the code, so every point above can be reviewed in a pilot.

Short answers.

Questions before a pilot.

Anything not covered here, ask in your pilot request.

What does a pilot involve?

You choose one AI application. Three assurance questions are agreed up front for the pilot to answer. Examples: Did personal data enter or leave the workflow unexpectedly? Did the agent use tools outside policy? Was deleted data actually removed from memory? At the end you receive one evidence report. Each finding in it points to the recorded event and to the requirement it relates to.

Can Superinspect disturb production?

It is built not to: it only observes and fails open, and the measured recording overhead is a median of 0.03 ms per call (0.02 ms without), in a test setup.

Does any data leave our network?

No. Superinspect itself sends nothing out; it runs entirely on your network.

Does Superinspect prove that we comply with the EU AI Act?

No. Superinspect provides evidence: each finding points to the recorded event and to a named requirement. Whether a requirement is met is for your auditors to judge.

Which systems are supported?

Anthropic, OpenAI, Azure OpenAI and LangGraph. Superinspect can also import sessions from Claude Code and OpenAI Codex; the Codex import is experimental. Personal-data detection is tuned for English text so far; German is in development.

What did your AI agent actually do?