offsend/ai-boundary-test

This repository is a small, safe test kit for checking whether a companion tool called Offsend actually stops an AI coding assistant from sending, reading, or running things it shouldn't. Everything sensitive inside it, like a fake API key and a fake certificate file, is deliberately made up and cannot be used to access anything real, so people can run these tests without any risk of leaking real secrets. The repository checks three specific boundaries. The first is a prompt check, testing whether a secret-shaped value pasted into a prompt gets stopped before it ever reaches the AI model. The second is a file-read check, testing whether the AI agent can be blocked from opening a sensitive file, such as the fake certificate. The third is a shell-command check, testing whether the user is asked to confirm before the agent runs a command that touches a sensitive file. A fourth, safe control test confirms that normal, harmless requests still work as expected, so the protections are not just blocking everything. To use it, you install Offsend itself, which currently runs on macOS and Linux, then clone this test repository and open it in the AI coding editor you want to check, such as Cursor or Claude Code. After that, you install Offsend's hooks for that specific editor, which connects Offsend's checks into the editor's own workflow. Support varies by editor: Cursor and Claude Code support all three checks, including the file-read and shell-command gates, while Windsurf and Codex currently only support the prompt check. From there, you paste a series of example prompts described in the README, one at a time, and compare what happens with the expected result listed for each test. The README explains that Offsend's checks run entirely on your own machine, and that prompts, file contents, and findings are not sent anywhere for analysis. It also states plainly that this is a demonstration and not a formal security benchmark, and lists specific limitations, such as the file-read protection relying on a list of sensitive paths rather than scanning every file's contents. Users are encouraged to try to find prompts or scenarios that slip past the checks and report them as issues on the main Offsend project.