How ReconCage is put together

An accountant uploads a bank CSV and an invoice register. A model plans the match and writes pandas. That program runs in a sandbox with no network, no secrets and a 20 second cap, then the sandbox is destroyed. The numbers on the report are claims pointing at that execution.

Internet
  |
  Web (FastAPI, Jinja, HTMX, SSE) on the VM
  |-- provenance store (SQLite) and content-addressed artifacts
  |-- canary HTTP listener on port 9999
  |-- SandboxDriver
  |     |-- Microsandbox microVM, Network.none(), when msb doctor passes (VX1)
  |     |-- Docker: gVisor if runsc is installed, otherwise runc
  |
  Vultr Serverless Inference  https://api.vultrinference.com/v1
  Runner image (pandas, numpy, rapidfuzz, matplotlib) baked in, because the sandbox cannot fetch packages

Threats

Threat	Control	Check
Exfiltration	No network in the sandbox, no secrets in its environment, canary on the host	A3, A4, A6
Disk wipe	Read-only root, copied inputs, sandbox destroyed after the exec	A5
Fork or infinite loop	PID cap and 20 second wall clock	A7
Memory bomb	512 MiB, no extra swap	A8
Prompt injection	Cells are wrapped as data. The scanner is advisory. The payload still runs inside the cage.	A2
CSV formula injection	Export prefixes cells that start with = + - @	A13
Made-up totals	Figures come from out.json claims. Replay uses the same code and no model.	A10, A11

On this machine

Active driver: docker (gVisor). Microsandbox is not the driver here: msb is not installed.

Team RewAi. Built for Vultr Agent Rush, 3–8 Nov 2026. MIT licence.