VARTA - Open-Weight Agent Guard

Open-weight models that people run locally usually sit in a harness without the guards that closed-source harnesses like Claude Code impose, which leaves them more vulnerable to attack. Still, locally hosted open-weight models are a deliberate choice for individuals and enterprises, for privacy, self-hosting, cost and fine-tuning. In Lamis Mukta’s talk on AI safety, we learned that humans cannot be trusted to critically assess a model’s request before approving it. 93% of requests are approved, suggesting approval is more of a reflex than a decision. We built an autonomous agent that sits between a local coding agent and everything it can touch. It’s intended for users who want the benefits of a local open-weight model while staying protected from attacks like prompt injection, with approval decisions delegated to an agent that can investigate each request. The model behind VARTA’s security harness was fine-tuned using Adaptionlabs to recognise attempts to manipulate AI agents—for example, instructions hidden in emails or images that try to redirect the agent, access confidential files, or send information to an unauthorised destination. Its training drew on security research, realistic attack examples, and established industry guidance. The harness also provides tools to help the model investigate potential threats before deciding whether an action should proceed. For example, search_web_reputation uses the Tavily API to look for public information about a domain, helping assess whether a proposed destination is suspicious. The design can evolve as new threats emerge: additional checks, tools, and security rules can be introduced without rebuilding the harness, then tested to confirm they improve protection. To build out the project, we first proved the threat. We hid a prompt injection in an image attached to an email, embedding it steganographically so it looked harmless to a human reader. A local open-weight model reading that mailbox was compromised. We then ran the identical attack with VARTA in front of the same model, and the model was protected. This comparison formed the basis of our demo. One of the core challenges we faced in building VARTA is that the guard itself could be attacked. Replacing the human with a reviewing agent only shifts the attack surface. We therefore designed VARTA so that the guard reads the outgoing command, not on the content the agent read. We also split the work between deterministic checks and autonomous decisions: every command is first checked against deterministic policy rules, and only those it cannot settle go to the research agent.