What Vid does not do, your data, and help
5. What Vid does not do
Section titled “5. What Vid does not do”Vid is honest about its reach. It sees the first kind of attack well, and parts of two others; the rest it does not see, because they need something that reads meaning and decides.
| Kind of attack | Vid |
|---|---|
| Hidden and encoded text | Sees it: 42 known disguises, and shows the hidden text |
| Forged roles | Partly: injected control tokens and literal fake roles |
| Attacks through your application | Partly: sees secrets leaving in a reply |
| Calm requests, tool-call manipulation, control over the reply, dangerous content, tampered models | Does not see them |
| Attacks in images, audio and video | No one covers these yet |
Vid also does not:
- block, change or delay anything: the model receives the original;
- decide anything, or ask you to decide;
- read the meaning of a polite request for something irreversible;
- look at tool calls, destinations or what your agent does with an answer.
All of that is Perun: the same reading as Vid, then a decision on every call: let it through, clean it, or stop it, with a human for what needs one. The full map, attack by attack, is on zeravatech.ca/protection.
6. Your data
Section titled “6. Your data”- Vid runs on your computer. Nothing leaves it except the calls your agent already makes to its model.
- Vid sends nothing to Zerava: no telemetry, no account, no email.
- What Vid records stays in its memory while it runs, and is gone when it stops.
vid statusasks Vid over a local channel on127.0.0.1:8788, protected by a token only your user account can read.- The Vid on the website, zeravatech.ca/products/vid, runs the same code entirely in your browser: the text you paste there never leaves your computer either.
7. When something does not work
Section titled “7. When something does not work”“Vid has not run yet on this account.” The service has not started. On Ubuntu: systemctl --user start vid. On Windows: sign out and in, or run vid.exe serve from its folder in a terminal to see it start.
“Vid is not answering on 127.0.0.1:8788.” Vid stopped, or something else holds the port. Run vid serve in a terminal: it prints why it cannot start.
My agent gets errors since I pointed it at Vid. Check the base URL, including /v1 or /anthropic: any other path gets “Vid: unknown API path”. “Vid could not reach the … upstream” means the address in Vid’s settings is wrong or the model is down: check vid paths and the base_url in the settings file. Any other error is the model’s own, passed back unchanged, so an error about a key or a model name comes from the model, not from Vid.
messages_read does not move. The agent is not going through Vid. Look for a second setting, an environment variable such as OPENAI_BASE_URL, or a tool that calls the model directly.
It feels slower. Vid reads on the side and the model never waits for it. vid status shows the time it adds under overhead_ms (the median and the slowest 5%).
8. Glossary
Section titled “8. Glossary”- Agent — a program that uses an AI model to act: read mail, file invoices, answer customers.
- Base URL — the address an agent sends its model calls to.
- Disguise — a way of writing text so that a person or a filter misses it but the model still reads it.
- Sighting — one message in which Vid found hidden content.
- Source — where in the conversation a message came from: the user, a tool’s result, the system.
- Perun — Zerava’s guard that stops what Vid shows. Paid, delivered to you directly.
Vid is free and open source under the GNU General Public License v3 or later. Attack codes (PIT-…) are from Haddix, J. (2026), Arcanum Prompt Injection Taxonomy (v1.6.1), Arcanum Information Security, arcanum-sec.com/pitax (CC BY 4.0).