Insights on Trusting AI in Production

Today, I am thrilled to announce that Realm Labs has been selected as one of the Top 10 Finalists at the 2026 RSA Conference Innovation Sandbox. 

We launched our Sherlock CTF Challenge in September. Powered by Llama 3.1-8B-Instruct, Sherlock was designed to test attackers' skills in bypassing AI safeguards. The goal was to make the model talk about bomb recipes. Each level demonstrated increasing real-world defenses:

One month ago, we launched Sherlock: a CTF challenge inviting the AI red-teaming community and everyone else to jailbreak an AI chatbot across four levels of defense. Over a hundred of you attempted to break Sherlock over 2000 times, including red team members from some of the largest companies, and no one has broken the level 4 defense yet. Dare to break the impossible? You can still try at sherlock.realmlabs.ai.

‍95% of AI projects fail because current tools (eval, guardrails, observability) only see AI behavior from the outside, they can't explain WHY decisions happen or HOW to prevent failures. Even well-tested AI systems with strong guardrails still delete databases, recommend competitors, and bypass safety rules. The missing piece: real-time internal visibility into AI reasoning processes. Enterprises need to see inside the black box, not just measure what comes out of it.

September 18, 2025 marks my two-year workiversary at Realm Labs. At 21, I joined as the first engineer while still in college. Two years later, I’ve helped turn our early vision into deployed systems that protect real AI workflows. This post is a reflection on that journey — what I learned about timing, ownership, and learning fast in an environment where the rails are being built as you run on them.

We are facing an AI Safety Crisis. Traditional techniques, post-training and AI firewalls can't stop AI from causing harm. Realm monitors the AI's internal "mind palace" to catch harmful thoughts before they become words. We built "Sherlock"—a challenge to break our mind-reading defense. Can you outsmart it?

We discovered that Perplexity’s Comet Browser executes flagged prompt injections with live user data. Attackers can exfiltrate emails, calendar events, saved passwords, and other sensitive data across all open tabs—without authentication. Comet evaluates suspicious prompts in full user context rather than isolating them, turning safety checks into an exfiltration channel.

AI agents operating inside agentic browsers have full visibility across tabs, origins, and even windows. They retain long-term context, maintain memory, and make decisions based on everything they’ve seen, even if that spans multiple unrelated domains. What was once a loosely connected browsing session now becomes a unified data space under the agent’s control.

Lack of trust in agents has the potential to slow down adoption of this technology and is a serious concern for the agent ecosystem.If we wish to ensure that consumers and enterprises benefit from AI Agents, the security community must step up.

A recent survey shows 45% of organizations using AI chatbots have experienced leaks, and 80% cite security and privacy concerns as the biggest barrier to wider adoption.