Do not trust the receipt. Try to break it.

Try the receipt attack

1. Generate and verify a real local receipt with the pinned package.
2. Open ~/.agentguard/demo/latest-receipt.json and copy the JSON somewhere safe.
3. Change one meaningful field. Good first targets are decision.action, decision.projectedCents, sequence, previousHash, or entryHash.
4. Paste the clean and modified receipts into the live verifier. A successful break is a modified semantic decision that still returns valid.

npx -y @agentguard-run/[email protected] demo && npx -y @agentguard-run/[email protected] verify

Open the live verifier

Try the policy attack

Use the SDK directly and reduce the case to one policy object plus one call input. State the verdict the policy requires, the verdict returned, the package version, runtime version, and the complete reproduction. Tests that depend on hidden prompts or a provider response are not reduced enough.

Useful boundaries include exact-cap equality, adjacent time windows, unknown model pricing, downgrade chains, missing capability claims, capability ordering, shadow mode, concurrent calls, and receipt sequence continuity. This list is a starting point, not a claim that those cases are broken.

Open the SDK package Read a tested harness

What counts

A result must reproduce against a published AgentGuard package with no modified AgentGuard source. A receipt break must preserve a changed meaning and still verify. A policy break must show an enforcement disagreement, not merely a policy you wish had different semantics. Denial of service, provider behavior, social engineering, and attacks on unrelated third-party systems are outside this challenge.

There is no prize program or bounty infrastructure on this page. Send a compact reproduction to [email protected]. We will rerun it before changing the record.