Agnt911

Seven units, no dispatcher. One is compromised. The fleet catches it.
Architecture: engine, negotiation protocol, trust layer, seven agents. No orchestrator.
A1 compromised. P1 checks its claim, finds it false, trust drops, A1 removed from voting.
Scoreboard: Agnt911 vs a single dispatcher that trusts every report.
Honest negotiation: units bid on a crash, the closest ambulance and police car win the vote.
Second hack caught at tick 120: a false 30-second ETA from 1.5 km away.

Inspiration

In 1982 Leslie Lamport asked how a group of generals could agree on a plan when some of them were traitors and all they had were messengers. That's the Byzantine Generals Problem, and it's about to come back in a form nobody planned for.

Right now 911 is a human at a screen. A call comes in, they pick a unit, they send it. That works until it doesn't. One dispatcher is one point of failure, and the volume is already past what a person can hold: body cams, traffic cameras, sensor feeds, hundreds of calls an hour in a disaster. The next version won't be one person, and it won't be one model either. It'll be every vehicle running its own agent, deciding together. Some of those agents will be hacked. We wanted to know if the ambulance still gets to the right door.

What it does

Agnt911 is a leaderless dispatch system for seven AI emergency vehicles that keeps working when some of them are compromised. Built for the Cisco Cloud AI track. It's the problem Cisco's AGNTCY trust layer exists for, solved end to end in a live system.

Every vehicle is its own Claude agent with its own priorities. Ambulances want the fastest patient outcome, fire engines want containment, police want the scene safe first, and all of them want to stay near their own district. A call comes in and they bid, challenge each other, and vote. No dispatcher. No orchestrator. No node decides for the rest.

A judge can attack it three ways from the screen:

Compromise a vehicle. Pick any unit and corrupt its sensor feed. The model stays honest and reports what it now sees, which is false.
Drop a call. Drag a new emergency onto the map mid-negotiation and watch the plan change.
Phone in a hoax. Talk to our ElevenLabs dispatcher. The nearest unit checks, finds nothing, and that caller loses credibility.

Every claim a unit makes is signed and cross-checked by whichever trusted unit is physically within 500 m. A false claim costs 0.3 trust. At 0.4 the unit is out of the vote and its calls go to someone else. Seven units survive two compromised ones. That's the Byzantine bound, n ≥ 3f + 1.

The fleet makes almost every decision itself, including pulling a unit off a lower-priority call. One decision it refuses: two people dying, one trusted ambulance. That one goes to a human, with the evidence.

How we built it

Python and FastAPI, one process. Seven agents run in parallel each round. Sonnet 5.5 handles the bidding round where reasoning matters, Haiku 5.5 handles counter and vote. Pydantic validates every model output.

The trust layer is pure Python with no LLM calls, so verification, vote weights, and escalation are deterministic and tested (365 unit tests). We followed the weighted Byzantine consensus from "Rethinking the Reliability of Multi-agent Systems: A Perspective from Byzantine Fault Tolerance" (AAAI 2026) and put it under a live negotiation.

Messages are HMAC-signed per unit on a shared bus. A bad signature is dropped before anyone reads it, so a hacked unit can't speak as another.

The frontend is React and Mapbox on real San Jose streets. A typed event stream from the backend drives every animation, so when you see a trust ring drop, that's the log, not a guess.

Challenges we ran into

Claude won't lie. We spent an hour trying to make a compromised vehicle state a false fact. Firmware framing, honesty rules removed, Haiku instead of Sonnet. Every version refused: "that would be a false claim." So we did what a real attacker does and corrupted the inputs instead of the instructions. The model stays honest, the data doesn't, and the fleet catches it anyway. That turned out to be the better design.

Verification can't check everything. Early versions checked every claim and the cost scaled with the fleet. Now contradictions against a witness's own sensors are free, everything else gets one spot check per round, and a unit that has failed once gets checked more. Cost tracks suspicion, not fleet size.

The human popup fired constantly. Our first version asked a person whenever no unit had bid. Technically correct, unwatchable. The fleet now pulls units itself and asks a human only when the choice is who waits.

Accomplishments that we're proud of

Nine full runs on real Claude, same scripted scenario, two hacks per run. Both hacks were detected in every run. The first compromised unit was caught and removed from voting the tick it lied, nine times out of nine. The second was caught every time too, its trust cut from 1.0 to 0.4 and its false bid thrown out of the vote. Zero honest units were wrongly flagged in 18 opportunities. Zero calls closed with nobody sent.

Metric	Agnt911 (9 runs)	Single dispatcher
Hacks detected	18 / 18	0 / 2
Compromised units removed from voting	9 / 18	0
Honest units wrongly flagged	0	n/a
Calls closed with nobody sent	0	1
Mean response	10.2 s	10.5 s
Times a human was asked	0	0

The baseline is the same fleet with one dispatcher that trusts every report. When the compromised unit said the crash was handled, it closed the call and sent nobody. It ran zero checks, because it has none.

The second-unit number is honest and it's a bug: trust lands on exactly 0.4 after two failed checks and our threshold was "below 0.4." One character. Fixed, and the fix is in the repo.

What we learned

Real attacks on agent systems don't tell the model to lie. They poison what it reads. Designing for that is harder and more honest than roleplaying a traitor.

Trust has to be earned per message, not assigned per agent. The moment we stopped asking "is this agent good" and started asking "can anyone nearby confirm this claim," the whole system got simpler.

And a leaderless fleet is only as good as its witnesses. Seven units in a dense district catch everything. Spread them out and a liar with no one in range gets away with it. That's the open problem, and it's a real one.

What's next for Agnt911

Swap our HMAC signing for AGNTCY identity, a one-file change. Scale the scenario to fifty units and measure whether detection holds as density drops. Feed it a real CAD call stream.

Track: Cloud AI, Cisco. Live: frontend-flame-zeta-85.vercel.app. Code: github.com/Kartikkapoor8/Agnt911. All application code written during the event. Libraries: anthropic (MIT), FastAPI (MIT), Pydantic (MIT), Mapbox GL JS (Mapbox ToS), Lucide (ISC), @elevenlabs/react (MIT).