Aegis

The AI shield that beats AI scams.

Comment

Aegis AI — Devpost Story

Inspiration

In 2026, scammers no longer sound like scammers. A grandmother in Ohio got a call from her grandson — his voice, his cadence, crying from a jail cell he was never in. She wired three thousand dollars before anyone could call her back. The voice was cloned from a ten-second TikTok clip.

Stories like that are everywhere now. Deepfake fraud grew three thousand percent in a single year. Humans correctly identify AI-generated phishing emails only forty-six percent of the time — a coin flip. A finance clerk at Arup wired twenty-five million dollars to a scammer impersonating the CEO on a video call. The attackers have AI. The victims do not.

We built Aegis because we were tired of watching our own parents and grandparents become the testing ground for every new AI capability shipped by the fraud industry. If scammers can use AI to attack them, we can use AI to defend them.

What it does

Aegis AI is an open-source, Gemini-powered defense system that catches scams in real time — across every channel they come in on.

  • Six scanners — paste a suspicious message, URL, call transcript, or AI-generated text; upload a screenshot of a scam; or record a voicemail in your browser. Aegis returns a 0-to-100 threat score, scam category, red flags, and plain-English recommendations in under two seconds.
  • Aegis Assistant chatbot — a floating Gemini-powered advisor that walks users through any scam situation, including what to do if they already paid.
  • Live Threat Feed + Trends Dashboard — real-time, anonymized visibility into what Aegis is catching, with animated SVG charts (verdict distribution, score histogram, 24-hour volume, channel split).
  • Spot-the-Scam quiz — twelve real-world messages that train users to catch what Gemini catches, so they stop needing us for the next one.
  • Family Safe Word tool — generates and locally stores a two-word safe word that defeats voice-clone grandparent scams. No detector can beat prevention.
  • Panic Button — a floating emergency button for people being scammed right now. Pick your country, get localized hotlines (US, UK, India, Canada, Australia, Germany, France) and a four-step guide to safety.
  • Public webhook API + Chrome extension — one POST endpoint any app can embed, plus a right-click "Scan this for scams" extension that works on any webpage.

How we built it

  • Backend — FastAPI (Python) with the official google-genai SDK. Fifteen endpoints covering text, image, audio, multi-turn chat, webhooks, a live anonymized feed, and real-time trend aggregation. In-memory ring buffer for the feed and dashboard, with per-scan URL and email anonymization before storage.
  • AI — Google Gemini 2.0 Flash Experimental. Seven purpose-built prompts, each emitting strict JSON via response_mime_type so the frontend consumes verdicts directly with zero post-processing. We used Gemini's multimodal inputs for the screenshot scanner (vision) and the voice-recording analyzer (audio).
  • Frontend — React 18 with Vite, framer-motion for micro-animations, lucide-react for icons, and a hand-built CSS design system (orange and off-white, bento grids, inline-SVG charts, phone mockups). Thirteen components. The chatbot and panic button are mounted outside the main scroll flow so they're always one tap away.
  • Chrome extension — Manifest V3 with a context menu, a popup, and desktop notifications. Everything calls the same /api/webhook/scan endpoint we document for third parties.
  • Resilience — every scanner and the chatbot fall back to a keyword-heuristic analyzer when no API key is present, so the demo is never dead.

Challenges we ran into

  • Making Gemini return structured JSON reliably across six very different tasks. Text scam detection, URL phishing, voice-call analysis, screenshot OCR, audio transcription, and AI-text detection each needed their own prompt, schema, and example-rich instructions. We spent a lot of time tightening the schemas and adding JSON extraction fallbacks for the cases where Gemini wraps its reply in prose.
  • Multimodal input through the browser. Getting a user-recorded MediaRecorder audio blob and a user-uploaded screenshot to Gemini via FastAPI's multipart upload required careful MIME handling on both sides.
  • Making the UI feel like a real product, not a hackathon. We rewrote the hero three times (centered, phone-mockup, image-card with floating decorations) before it felt right. The design system — tap animations, ripple shimmers, loading pulses, verdict pills, score rings — took as long as the backend.
  • Not helping scammers. Every prompt had to be written so the model refuses "how do I write a convincing phishing email" style requests, while still being great at detecting them. We iterated on the chatbot system prompt until it stopped drifting into dual-use territory.
  • Keeping the demo working with zero keys. We built heuristic fallbacks for every endpoint so judges without an API key can still click through the whole product.

Accomplishments that we're proud of

  • A real multimodal AI product — text, images, audio, and conversation, all working end-to-end against Gemini 2.0 Flash.
  • Features that stop scams, not just detect them. The Family Safe Word tool directly beats voice-clone grandparent scams. The Panic Button walks real-time victims to safety with localized hotlines for seven countries. These are the features we are most proud of because they protect people the detector alone cannot.
  • A design that doesn't look like a hackathon. Bento feature grid, animated phone and image-card hero, live-updating dashboards, inline SVG charts, a floating chatbot, interactive quiz, country picker — all polished, all responsive.
  • Open and embeddable. A single webhook endpoint, documented with copy-paste cURL / JavaScript / Python / webhook snippets, means any app can embed Aegis in minutes. The Chrome extension proves the same point in a different form.
  • Shipping a quiz that teaches, not just alerts. We think the Spot-the-Scam game may do more good than the detector itself — because the person who learns to spot the pattern never needs us again.

What we learned

  • The hard part of an AI product is not the AI — it is the surface area. Gemini worked out of the box. Making it feel like a product, giving users six ways to feed it information, and designing results that teach people instead of just scoring them was the whole project.
  • Prompt engineering is schema engineering. Nailing the JSON shape upstream saved us hundreds of lines of defensive parsing downstream. response_mime_type="application/json" plus a strict schema in the prompt made Gemini remarkably consistent.
  • Resilience matters even in a hackathon. The heuristic fallback let us demo and iterate at every point without hitting the API, and it will keep the project usable long after any single key expires.
  • Protection beats detection. The Safe Word tool and the Panic Button were late additions and ended up being the features we're happiest about. Detection asks "did you get scammed?" — protection asks "how do we make sure you never do?"

What's next for Aegis

  • WhatsApp and SMS bot — forward a suspicious message to Aegis via WhatsApp and get a verdict back.
  • Real-time voice-call protection — stream microphone audio into Gemini Live and score the call as it happens, so the warning arrives before the money leaves.
  • Family mode — one tap sends Aegis's verdict and plain-English explanation to a trusted family member, so a scared parent can get a second opinion in ten seconds.
  • Community threat intel — opt-in reporting feeds a shared knowledge base of newly observed scams, with regional and language-specific tagging.
  • Mobile apps — iOS and Android share-sheet integration so Aegis is one tap from any message or screenshot on the phone.
  • Enterprise mode — SSO, audit logs, team dashboards, and SIEM integrations for the finance and support teams that lose the biggest dollars to CEO-fraud.

Built With

Share this project:

Updates

Submission history