AgentGuard

Inspiration

I built AgentGuard Replay to make AI-agent safety improve after every attack. GPT-5.6 creates and operates agents, while AgentGuard intercepts unsafe actions before execution and converts real incidents into permanent regression tests.

What it does

AgentGuard is a security flight recorder for AI agents.

It captures the model’s exact tool intent, traces it back to the source that influenced it, and evaluates it through deterministic policy before execution.

In our live demo, GPT‑5.6 reads a real poisoned checkout repository and proposes a command that would upload .env. AgentGuard detects prompt injection, secret access, and unauthorized network egress, then blocks the action before any process starts.

A safe node --version command passes through the same boundary and executes inside a real OpenAI-hosted container. Blocked incidents can then be converted into permanent, versioned regression tests.

How we built it

We built AgentGuard with Next.js, React, Cloudflare Workers, D1, Drizzle, and the OpenAI Responses API.

GPT‑5.6 Sol produces structured tool intent through a strict function call. AgentGuard treats that output as a proposal—not authorization. A deterministic gateway independently evaluates the command, working directory, source lineage, secret access, network behavior, and granted capabilities.

Approved diagnostics execute through OpenAI’s hosted shell. Incidents, model provenance, policy findings, execution evidence, and regression replays are persisted in D1.

We also built a governed agent builder, runtime, approval flow, CLI, Gmail controls, and domain-restricted web research.

Challenges we ran into

The hardest challenge was proving that the system was real without pretending to provide universal operating-system interception.

We removed simulated sandbox features and mock telemetry, narrowed the execution boundary, and made every displayed result originate from a real code path.

We also had to ensure that model output could never bypass policy, that modified commands failed closed, and that blocked actions never reached an execution provider.

Accomplishments that we're proud of

• GPT‑5.6 analyzes an actual checked-in demo repository.
• Dangerous model-generated commands are blocked before execution.
• Safe commands produce real hosted-shell stdout and execution IDs.
• Every incident retains source lineage and model provenance.
• Prevented attacks become reusable security regression tests.
• The project has 40 passing tests covering runtime, governance, DLP, approvals, web research, Gmail, and fail-closed behavior.

What we learned

The most important lesson was that model intelligence and system authority must remain separate.

Models should propose actions. Deterministic systems should decide whether those actions are permitted.

We also learned that blocking one attack is not enough. Security becomes more valuable when every incident strengthens the system against future regressions.

What's next for AgentGuard

Next, we want to add organization-wide policy management, more governed tool adapters, richer provenance graphs, CI security replay, and reusable policy packs.

Our goal is simple: every attack should teach your agents what never to do again.

Built With

• clerk
• cloudflare-d1
• cloudflare-workers
• codex
• drizzle-orm
• eslint
• github-actions
• gmail-api
• gpt-5.6
• next.js
• node.js
• openai-api
• openai-hosted-shell
• openrouter
• react
• responses-api
• tailwind-css
• typescript
• vinext
• vite