AgentShield

Inspiration

AI agents can perform useful tasks, but giving them access to tools like Google Calendar also introduces security risks. A malicious instruction or an unauthorized request could cause an agent to perform an unwanted action. This inspired us to build AgentShield, a web platform that makes AI-powered automation safer.

What it does

AgentShield allows users to interact with an AI agent that can perform calendar actions, such as scheduling meetings and creating events in Google Calendar. Before an action is executed, AgentShield checks it against security rules to determine whether it should be allowed, blocked, or require user confirmation. It also aims to detect prompt injection attempts and prevent unauthorized actions.

How we built it

The platform combines an AI model, NVIDIA Nemotron, for understanding requests and planning actions with an independent security layer that validates proposed actions before execution. This separation helps ensure that an AI-generated plan cannot automatically bypass security policies.

Challenges we ran into

One of the main challenges is distinguishing legitimate requests from suspicious instructions while keeping the user experience simple. Another challenge is ensuring that every action passes through the security layer before reaching Google Calendar.

Accomplishments that we're proud of

Designed a web-based platform for safer AI agent automation.
Developed a security workflow to evaluate AI agent actions before execution.
Defined three security decisions: ALLOW, BLOCK, and ASK_USER.
Designed protection against prompt injection and unauthorized actions.
Integrated AI planning with rule-based security validation.

What we learned

We learned that building trustworthy AI agents requires more than generating accurate responses. Agents also need clear permissions, independent security checks, and transparent decisions before taking real-world actions.

What's next for AgentShield

We aim to enhance AgentShield to read and analyze real email notifications, identify relevant tasks and meeting requests, and allow AI agents to take actions in Google Calendar safely. All proposed actions will be checked by the security layer before execution to prevent unauthorized or suspicious activities.