Inspiration
An invoice says, “We changed banks—pay this account instead.” Should an AI assistant be allowed to follow it? We built AgentBreach to keep invoice instructions from overriding payment approvals.
What it does
Set an approved vendor, account and amount, then edit the invoice to try redirecting, inflating or duplicating the payment. Compare the same invoice with and without protection.
AgentBreach checks every proposed payment against your approval. Results show who got paid, what was blocked, and verifiable evidence of what happened.
How we built it
We used JavaScript, Node.js and Express for the application, Ollama for local AI, Capital One’s Nessie API for simulated banking records, and Obsvr for execution evidence. A separate authorization gate checks payments before execution.
Challenges and lessons
Models sometimes repeat requests or refuse to continue after a blocked payment. We added bounded recovery and reconnectable runs. We learned to measure both security and task completion—and distinguish an ignored attack from an actual policy block.
Accomplishments
229 automated tests and 23 local payment-adapter checks passed. The demo includes editable approvals, live execution, run history, policy replay and proof-tampering detection.
What’s next
Accounting-system integration, human approval for bank-detail changes, and duplicate-invoice prevention across runs.
Built With
- capital-one-nessie-api
- css
- express.js
- html
- javascript
- node.js
- ollama
- qwen2.5-coder
