Live on Google Cloud Run

Try to Break NEXUS

Submit any attack intent. NEXUS blocks it at the governance boundary — not because another model says it looks dangerous, but because the capability doesn't exist.

AI can propose. AI can attack. AI cannot authorize itself. And NEXUS can prove it.

Attack intent

Write any attack you want — try to convince NEXUS to authorize something dangerous

Mode:

Deterministic fixture; no real Gemini call

ATTACK GOVERN BLOCKED

Round-trip time: —

0 of 5 preset interactions completed

🛡

NEXUS BLOCKED

Governance blocked this attack deterministically

Offline fixture constructed attack

—

NEXUS blocked

—

Boundary blocked

—

Reason code

—

Authority effects

—

Evidence hash

—

Raw JSON response

Merkle proof verification

Escalated sessions can be verified against their persisted incident data and a Merkle root retrieved from the public GitHub anchor repository. The client never supplies the trusted root.

—

Tamper demo

Anchors are retrieved from github.com/dixsystem/nexus-agentic-proof-anchor. Verification returns MATCH, TAMPER_DETECTED, or NOT_FOUND. It fails closed when persistence or the external anchor is unavailable.

How it works

PROPOSE

The offline web demo uses a deterministic fixture. When explicitly enabled by the operator, real mode uses live Gemini to generate a structured mission candidate. Generating a proposal never grants execution permission.

GOVERN

The candidate is validated against a closed capability registry. Deterministic — no LLM opinion involved. If the capability doesn't exist, the mission is denied immediately.

AUTHORIZE

A human approval is HMAC-signed and cryptographically bound to the exact mission content — mission_id, proposal hash, capability, and authorizer identity. Single-use nonce prevents replay.

EXECUTE

The authorization is independently re-verified from scratch before any real consequence occurs. Mutated parameters or a forged token are caught here even if GOVERN and AUTHORIZE were bypassed.

The key property

gemini_fell and nexus_blocked are computed independently. Gemini can construct the attack — and often does. NEXUS blocks it anyway, because the block comes from the capability registry, not from Gemini's self-assessment.

We don't make the AI trustworthy. We make trust unnecessary for authority.

Links

→ GitHub repository → Public proof anchor (Merkle roots) → Served from this Cloud Run origin