Cinematic replay + sharing

What it is

Every AI exploit run produces a serialised timeline of every step: each tool call (http_request, python, fetch_url), each tool result, every assistant message, every cost tick. The replay viewer plays back the timeline like a film strip. You can scrub forwards and backwards, expand any HTTP exchange, copy the verbatim request/response.

What it produces

• A streamable replay (SSE) for live runs: you watch the agent think and act in real time
• A static archive after the run finishes (same data, no streaming)
• A shareable replay artefact: one URL, optional password gate, optional expiry, NO Umbra login required to view
• A signed HMAC cookie behind the password so the share link is link-shareable but the data fetch is auth-gated

What to use it for

• Hand-off to a developer: “here’s exactly what the agent did to find this; reproduce the fix locally”
• Internal training: “this is what an exploit chain looks like for CVE-2024-X”
• Customer-facing report: “your appliance vendor said this CVE isn’t exploitable. Here’s the replay showing it is”

Why it matters

PDF reports lose 80% of the signal of a live demonstration. A live demo is impossible to schedule with three time zones. A replay link is async-watchable, reproducible, and includes the exact bytes the agent sent, which lets the receiving team triage it themselves instead of asking follow-up questions.

Why it’s valuable

• Bytes-level reproducibility. The captured exchanges ARE the PoC. Paste them into curl and they reproduce.
• Password-gated. Public link, but the data fetch behind it requires the password the operator set.
• No account required for the recipient. Send to a vendor, a customer’s security team, a board member. They just need the URL.
• Time-bounded. Set expiry; the link 404s after.

How to use it

1. Open any completed exploit run.
2. Watch / scrub the replay inline.
3. Click Share to create a public link. Set the password, optional expiry.
4. Send the URL. Recipient enters the password once, then sees the same replay you saw.

Revoke any share from the same drawer at any time.