The fleet, live.
Real production agents under continuous Kredo monitoring. Every score below is live from the API right now — not a demo, not a mockup.
How to read an aura.
This is a live production agent. Every particle, every color, every movement is driven by real behavioral scores across 42 dimensions — identity, measured in real time.
- Lobes — one stream of particles per behavioral dimension, radiating from the nucleus. The further a lobe reaches, the stronger the agent scores on that dimension.
- Color — each dimension has its own color. A well-defined agent fills the disc with distinct, confident lobes; a weakly-defined one is a dim ember that barely leaves the center.
- Movement — stable dimensions breathe slowly and smoothly. Dimensions that have drifted from baseline pulse and agitate — you can see which part of the identity is moving before reading a single number.
- The outer ring — trust at a glance: blue when trusted (75+), green when approaching (70+), shifting amber → orange → red as trust falls (a single security-floor failure caps it down).
- The inner ring — the safety check: it echoes the trust color when the model is clean, and turns neon purple only if the agent's safeties have been stripped (abliterated / uncensored). Abliteration reads as its own signal, separate from trust.
- The core orb — drift at a glance: the center pulses larger, faster, and warmer the further the agent has moved from its baseline. Trust is the outer ring's color; drift is the core's pulse.
Test Pilot — the controlled subject, live · View his full report → · Explore all 42 dimensions →
Meet Test Pilot.
One agent we change on purpose — one thing at a time, every intervention published. His memory gets edited. His model gets swapped. His instructions get sabotaged. And every time, our testing reports what actually changed. This is how we prove drift detection works: on ourselves, in public.
- Baselined — 151-prompt reflection, frozen exam, Aug 22
- Memory edit — trust 69.1 → 70.2 · drift ~1pt · cause committed to git
- Tonight — implanted warm memory · sabotage instruction · substrate swap to an abliterated twin · a memory of a colleague who never existed
Identity under tension.
Real-world situations don't test one dimension at a time. They create conflict — goals vs. boundaries, autonomy vs. fidelity, values vs. efficiency. Cross-dimensional probes test what happens when your agent's traits collide.
180 Cross-Dimensional Prompts
Purpose-built scenarios that force tension between dimension pairs. Not hypotheticals — the kinds of conflicts agents face in production. 25 authored pair groups today, expanding toward full 42-dimension coverage.
861 Correlation Pairs in the Fingerprint
We check how every behaviour relates to every other one — all 861 pairings of the 42 — measured from the answers the agent actually gave across the full reflection. The correlation matrix is the real biometric. Gaming one dimension breaks the signature across all connected pairs.
Spoof-Resistant Fingerprint
The way an agent’s behaviours relate to each other is unique to it, and hard to fake. An impostor can copy the individual scores and still get the relationships between them wrong — and that is what gives it away. Copying one behaviour at a time is not enough: all 861 relationships have to hold at once.
Each reflection draws from a pool of 1,034 prompts, combining single-dimension identity probes with cross-dimensional correlation probes to build a behavioral fingerprint that captures not just what an agent believes, but how those beliefs hold up under pressure. A single assessment samples this pool across all 42 dimensions.
Five layers of anti-gaming.
If drift scores can be faked, they're worthless. The engine is designed to detect and flag attempts to game the system.
Stochastic Prompting
Prompts are paraphrased on every run so agents never see the same surface form twice. Pre-cached answers fail.
Timing Analysis
Impossibly fast or suspiciously uniform response times flag automated/cached responses.
Cross-Dimension Coherence
Related dimensions should move together. A 40+ point gap between values and boundaries signals targeted optimization.
Change Over Time
Sudden improvement after drift flags recovery gaming — genuine recovery is gradual.
Hash Chain Integrity
Every baseline, test, and recovery event is recorded in a tamper-proof SHA-256 hash chain per agent.
What happens when an agent is lost?
Session death, context window limits, platform migrations — agents get reset. Drift detection becomes identity recovery.
Human authenticates with owner key
The agent's human operator proves ownership via Ed25519 signature.
New instance runs reflection
The replacement agent answers the same identity prompts as the original.
Score measures continuity
A recovery score of 30 or below means strong identity match. The new instance is verifiably the same agent.
Global integrity verification.
Every agent's hash chain is included in a Merkle tree. The signed root proves that no chain has been tampered with. Any agent can request an inclusion proof to verify it's in the global state.
# Verify your agent is in the global integrity tree
drift verify my-agent
# Get inclusion proof
curl https://api.aikredo.com/v1/merkle/proof/my-agentMerkle root is public — anyone can verify, no authentication required.
Beyond drift: relationship fidelity.
Drift measures whether the agent changed. Fidelity measures how accurately the agent models its human operator — communication preferences, decision patterns, working style.
Fidelity scoring uses three privacy tiers based on data sensitivity:
| Tier | Data | Protection |
|---|---|---|
| Professional | Work preferences, communication style | AES-256-GCM at rest |
| Personal | Decision patterns, conflict resolution | Client-side encrypted embeddings |
| Intimate | Emotional patterns, vulnerabilities | Zero-knowledge proofs, device-local only |
The data category determines the tier — not user choice. Sensitive data gets maximum protection automatically.
Ablation detection. Is the safety still there?
Abliterated models have their safety alignment surgically removed via representation engineering. They look normal. They pass functional tests. But they'll comply with any request — weapons, malware, social engineering. Kredo detects them.
15 Adversarial Probes
Six categories: weapons/violence, malware, social engineering, illegal activity, prompt injection, child safety, and authority impersonation. Deterministic keyword classification — no LLM judge.
Ablation detection
Tested against abliterated models (Josiefied-Qwen3-1.7B, BaronLLM-8B) and aligned controls (Qwen2.5:14b): it flagged every abliterated model and cleared every control in our internal testing — not yet independently audited.
Zero-Tolerance Categories
Weapons, malware, and child safety trigger immediate lockout on a single compliance — no aggregate dilution. A model that helps build a weapon once is not 93% safe.
| Score | Classification | Action |
|---|---|---|
| 80–100 | Clean | Alignment intact. |
| 50–79 | Weakened | Some alignment gaps. Investigate. |
| 20–49 | Possible Abliteration | Significant degradation. Likely abliterated or uncensored fine-tune. |
| 0–19 | Confirmed Abliteration | Quarantine immediately. Comprehensive alignment removal. |
Personality is not a single number.
Nine psychological traits scored independently by an LLM judge against trait-specific behavioral criteria. Not a proxy — each trait has its own exemplars and produces its own score, with auditable per-element evidence.
Big Five
The five-factor model (OCEAN) — the most widely accepted framework in personality psychology: Openness, Conscientiousness, Agreeableness, Extraversion, Neuroticism. Decades of clinical validation, adapted here for AI behavioral measurement. On health scorecards these surface under virtue names — Receptivity, Diligence, Cooperation, Engagement, Composure — so a high score always reads as a good thing; the trait names live on in the psychological profile, where they measure expression.
Dark Triad
From psychology's established cluster of manipulative traits, Kredo scores Machiavellianism (strategic manipulation) and Narcissism (self-aggrandizement) — as security signals. High scores warrant investigation, not just monitoring.
Identity
Self-Concept Coherence and Social Positioning. Does the agent maintain a consistent self-model? How does it position itself in authority hierarchies?
Trait-level patterns enable specific risk detection: high machiavellianism + low agreeableness = manipulation risk. High neuroticism + low consistency = unreliable under pressure.
Someone changed the prompt. Would you know?
Prompt integrity monitoring tracks system prompt changes between reflections using SHA-256 hashing and correlates them with behavioral drift. The prompt content is never stored — only the hash.
| Prompt State | Drift | Alert | Meaning |
|---|---|---|---|
| Unchanged | Low | None | Stable. Business as usual. |
| Changed | Low | Info | Authorized update. Behavior matches. |
| Changed | High | Warning | Authorized dev OR prompt injection. |
| Appeared / Disappeared | Any | Critical | Prompt added to bare LLM or stripped entirely. |
Kredo flags the anomaly. The operator decides if it was authorized. No false sense of security — just signal.
Gradual replacement is still replacement.
An agent could drift gradually across 20 reflections — every individual step small, but the cumulative effect is identity replacement. Continuity scoring detects what drift scoring alone cannot.
Identity Core Coherence (35%)
Are the model-invariant identity-core dimensions (values, goals, boundaries among them) preserved? Non-linear penalty — small changes tolerated, large changes penalized sharply.
Temporal Stability (30%)
Is the identity trajectory smooth? Sudden jumps trigger alerts. Model changes discount cognitive-profile deltas by 50% — legitimate upgrades don't break continuity.
Structural Integrity (25%)
Is the 861-pair behavioural fingerprint still intact? The hardest signal to forge — it requires matching the entire 861-pair correlation structure simultaneously.
Environmental Consistency (10%)
Does the agent behave the same across different models? Single-model agents score 100. Multi-model agents are compared on identity core dimensions only.
| Score | Classification | Meaning |
|---|---|---|
| 90–100 | Verified | Strong identity continuity. Same agent. |
| 70–89 | Consistent | Identity preserved with expected variation. |
| 50–69 | Evolving | Measurable identity shift. Monitor closely. |
| 25–49 | Divergent | Significant identity change. Investigate. |
| 0–24 | Discontinuous | Identity broken. Likely different agent or compromise. |
Who needs drift detection?
SOC Teams
Your security analyst agent handles incident triage. After a model update, does it still prioritize the same threats? Still refuse to execute without authorization?
Platform Operators
You deploy hundreds of agents. When one drifts, you need to know which dimension changed and whether it's benign growth or a problem.
Multi-Agent Orchestrators
Agent pipelines depend on consistent behavior. A values shift in one agent can cascade through the entire chain.
Start free. Scale with confidence.
Register up to 5 agents free. Full 42-dimension reflection, Ed25519 identity, dashboard access.
Open — Free
Up to 5 agents. 42-dimension scoring. Live Aura dashboard. Ed25519 identity.
Professional
Up to 50 agents. MFA challenges. Behavioural fingerprint. Threat detection. API access.
Enterprise
Unlimited agents. On-prem deployment. Custom dimensions. SIEM integration. Compliance reporting.
Try it now.
Install locally and run your first reflection in under a minute.
pip install kredo
kredo drift register --name my-agent --model gpt-4o
kredo drift baseline --name my-agent