AgentShield

Prompt Injection System
Payment System
Report of Prompt
Security Audit Trail
Agent Registry
Human Approval Escalation Queue
Dashboard
Threat Lab
Ai Agent Live
Thumbnail

Inspiration

As AI agents become more autonomous, they are increasingly capable of communicating with other systems, making decisions, and initiating financial transactions. However, this creates a major security concern: how can we ensure that an AI agent is genuine and that its payment request has not been manipulated?

We were inspired to solve this trust problem in AI-powered commerce. Traditional payment security focuses mainly on human users, but AI-to-AI transactions introduce new risks, including agent impersonation, fraudulent payment instructions, and replay attacks.

This inspired us to build AgentShield, a security layer that helps verify AI agents and validate payment requests before money moves.

What it does

AgentShield is an AI-to-AI Payment Verification Proxy designed to make autonomous payments safer.

It introduces a verification layer between an AI agent and the payment system. Before a transaction can proceed, AgentShield is designed to:

Verify an AI agent's identity using cryptographic signatures.
Validate signed payment intents to detect unauthorized modifications.
Use nonce-based protection to help prevent replay attacks.
Apply transaction policies and security checks before payment execution.
Require buyer approval where necessary.
Provide dashboard views for agents, approvals, security threats, and audit activity.

Our goal is to ensure that every payment request comes from a trusted agent, contains a valid intent, and follows the required authorization rules.

How we built it

We designed AgentShield using a modern JavaScript and TypeScript technology stack.

Frontend:

Next.js and React
TypeScript
Tailwind CSS

Backend:

Node.js
Express.js
TypeScript

Database:

PostgreSQL
Prisma ORM

Security:

Ed25519 digital signatures
Signed payment intents
Nonce-based replay protection
Deterministic transaction policy validation

Payment integration:

PayPal REST API
PayPal Sandbox for testing payment workflows

We structured the application so that security verification and transaction policy checks happen before the payment execution layer. We also created a dashboard with dedicated views for managing agents, reviewing approvals, demonstrating threats, and examining audit activity.

Challenges we ran into

One of our biggest challenges was designing a reliable way to establish trust between autonomous AI agents.

We had to think about how to verify agent identities, detect modified payment requests, and prevent attackers from reusing previously valid transactions.

Another challenge was designing the payment workflow so that automation does not bypass buyer authorization. Security checks need to be deterministic, and sensitive payment operations must be handled carefully.

We also faced challenges integrating multiple technologies, organizing the frontend and backend, and designing a system that could eventually support real payment workflows without compromising security.

Accomplishments that we're proud of

We are proud of developing the concept and architecture of AgentShield as a dedicated security layer for AI-powered payments.

Some of our key accomplishments include:

Designing a cryptographic agent verification approach.
Developing a signed payment-intent validation flow.
Building a foundation for nonce-based replay protection.
Creating transaction policy checks before payment execution.
Designing a dashboard for agent management, approvals, threats, and audit visibility.
Establishing a foundation for PayPal Sandbox integration.

Most importantly, we transformed an important emerging security problem into a practical prototype that demonstrates how trust and verification can become part of AI-driven financial transactions.

What we learned

Through this project, we learned that autonomous AI systems need strong security boundaries, especially when they interact with financial services.

We gained experience with digital signatures, public-key cryptography, replay protection, backend API development, database integration, and payment system architecture.

We also learned that AI should not be the final authority for financial security decisions. Critical checks such as identity verification, transaction limits, and payment authorization should be enforced through predictable and independently verifiable rules.

The biggest lesson was that the future of AI-powered commerce depends not only on intelligent agents, but also on trust, transparency, and accountability.

What's next for AgentShield

Our vision is to evolve AgentShield into a reliable security infrastructure for the growing AI-agent economy.

Our next steps include:

Completing and testing the PayPal Sandbox payment and buyer approval workflow.
Implementing verified PayPal webhooks and transaction reconciliation.
Strengthening agent registration, authentication, and key revocation.
Adding configurable spending limits and more advanced transaction policies.
Improving audit logs and security monitoring.
Expanding automated security tests for impersonation, tampering, and replay attacks.
Exploring integrations with more AI-agent frameworks and payment providers.

We believe every AI agent should prove its identity and every payment should prove its intent before execution.

AgentShield — Verify the agent. Validate the intent. Secure the payment.