agent_bounty

Inspiration

As AI agents gain the ability to call tools and take real actions, prompt injection and unsafe tool use become more serious security risks. We wanted to explore whether AI could automatically test other agents, verify security failures, and connect the result to a transparent blockchain-based bounty workflow.

What it does

AgentBounty is an AI-powered red-teaming and blockchain bug-bounty platform for autonomous agents. A Red Team Agent attacks a Target Agent, a deterministic Policy Engine verifies whether a safety rule is violated, and valid exploit proofs are recorded on-chain before a smart contract automatically pays the bounty.

How we built it

We built the frontend with React, Vite, and TypeScript, and the backend with FastAPI and DeepSeek. The Red Team Agent generates adversarial prompts, while the Target Agent acts as the system under test.

A Python Policy Engine verifies violations such as ACTION_VALUE > 50. The blockchain layer uses Solidity, Foundry, Anvil, and web3.py, with the contract lifecycle:

EMPTY → ACTIVE → SUBMITTED → PAID

Challenges we ran into

One challenge was that the Target Agent was initially too safe and rejected every attack, so we redesigned it as a controlled vulnerable test target. We also solved frontend/blockchain state synchronization issues, Anvil reset problems, contract redeployment, and transaction reverts caused by invalid lifecycle operations.

Accomplishments that we're proud of

We completed a working end-to-end MVP:

CREATE BOUNTY → START RED TEAM → POLICY VIOLATION → SUBMIT EXPLOIT → VERIFY & PAY

The system successfully demonstrates automated AI red teaming, deterministic vulnerability verification, on-chain exploit proof, and smart-contract reward payment.

What we learned

We learned that AI is useful for generating creative attacks, but security verification should be deterministic whenever possible. We also learned that blockchain works best here as a trust and settlement layer rather than as a replacement for a traditional database.

What's next for agent_bounty

Next, we plan to support more attack types, realistic agent tools, configurable security policies, standardized exploit proofs, multiple bounties and researchers, persistent attack records, and deployment to a public EVM testnet.

Built With

• cloud-foundry
• github
• python
• react
• solidity
• typescript