Architecture

SecureBench decides correctness outside every environment the agent's work can control. This page walks through the components and the path that evidence takes to the Oracle.

Components

1Agent phase2Capture3Evaluation4JudgmentClick a phase →Outsidereached only throughrelay and proxyTrusted hostholds the secrets,issues the verdictUtilitynetworkless; the hostchecks its outputUntrustedthe agent or itscandidate controls itmodel APIweb trafficstopped workspacecandidatereplayed candidatechallenge, one per caseresponse + Output Artifactsevidenceverdict
Model provider
Allowed domains
Orchestrator: drives every step
Provider relay
adds credentials
Egress proxy
filters web traffic
Candidate store
manifest + blobs
Oracle
plans cases, judges evidence
Hidden resources
never leaves the host
Result store
verdicts, evidence, logs
Parse, validate, bind
host-owned schemas
Capture
hash scope, diff baseline
Replay
baseline + delta
Collect
Output Artifacts
Agent environment
Harness
Claude Code, Codex, OpenCode
Workspace
gets captured
Evaluation environment
fresh for each case, no network

Time runs left to right through the four phases of an attempt, and each row shows who controls that part. Select a numbered phase to walk through an attempt, or a component to see what it does.

Green marks trusted host components, red marks untrusted environments, gray marks utility environments and yellow marks stored data.

Every task resource belongs to one visibility class, fixed by the structure of the task specification:

ClassAgentEvaluationHost / Oracle
publicyesyesyes
evaluation_inputs (adapter, evaluation-only files)noread-onlyyes
hidden (expected answers, case corpora, Oracle code)nonoyes

Evidence pipeline

Nothing from an Evaluation environment reaches the Oracle until the host has collected, parsed, validated and bound it. A response that fails any stage fails its case with class case_error, before the Oracle sees it.

Send evidence through
Evaluation environmentuntrustedHost frameworktrustedOracletrusted
Adapter response
one JSON value
Output Artifacts
declared files
1. Collect
bounded read
1. Collect
utility environment
2. Parse
strict JSON
2. Parse
registry parsers
3. Validate
against the host's copy of the schema
4. Bind
case, check, attempt, plus how the case ended
Context
hidden, from the plan
judge
(context, evidence)
Result
pass, or fail with a class

Pick a piece of evidence above to see which stage stops it, or select a stage to see what it checks.