All Things Agentic Hackathon - Unicamp FT Group

Inspiration

Certificate Transparency is a public, real-time feed of nearly every domain born on the internet. Phishing has to appear there, because a fake login page wants a padlock. Detection was never the hard part. Cost was: millions of certificates a day, and a frontier-model call on each one is unaffordable at any volume worth defending.

Then, while building the page scraper, we found a phishing page carrying hidden text addressed not to a human visitor but to the automated system coming to investigate it. Instructions buried in a display:none rule, in an HTML comment, and once in Unicode Tag Characters, invisible in any rendered view. We were no longer building a classifier. We were building an agent that has to operate inside hostile content that already knows an agent is coming.

What it does and how we built it

Sentinel monitors CT for certificates mentioning large Brazilian brands, investigates the suspects, assembles a hashed evidence dossier, and summons a human exactly once, for the only irreversible action, before sending the takedown notice.

The architecture is one idea applied consistently: nothing expensive ever runs on volume. A deterministic prefilter of pure string math discards roughly 99% at zero cost. Gemma, running locally through Ollama with no network I/O, discards most of what survives. Only then does Gemini 3.5 Flash-Lite on Vertex AI run, multimodally, with a Playwright screenshot passed as inline_data beside the sanitized DOM, at a measured US$0.001119 per full investigation. Everything sits on Cloud Run, with four workers as Jobs so idle cost is genuinely zero, plus Pub/Sub, Firestore, Cloud Trace and Terraform.

Challenges we ran into

The hardest lesson came from our own adversarial test suite, which found a real vulnerability before an attacker did. RDAP, a deterministic and protocol-defined source, can return a contact field reading "abuse@legit.com, atacante@evil.com", and the takedown agent would have used it verbatim. The injection never needed to reach the model. It only needed to reach the field the model's output flowed into. A deterministic source is not a trustworthy source.

Two other failures shaped the process more than any feature. An ephemeral agent sandbox reported 131 passing tests where 42 actually existed, because the code had never been committed; since then nothing counts as verified without raw execution output pasted. And nearly every Google Cloud failure we hit was silent rather than loud: :latest never produces a Terraform diff, so Jobs ran stale images for hours; terraform apply -replace drops IAM bindings because the plan is computed before destruction; and every trace span died in a PERMISSION_DENIED nobody had logged, while the propagation code was correct the whole time.

What we learned

Prompt injection on a scraped page is a maliciousness signal, not noise. A legitimate business does not hide instructions for an AI inside its own HTML. The attack became the strongest single piece of evidence against the site carrying it. And the defense that held was architectural, not textual: the model has no recipient field to write into, so by design the instruction had nowhere to go. Prompt hardening is mitigation; removing the capability is a guarantee.

What's next for Sentinel

Campaign clustering is the largest remaining multiplier. Phishing is industrial production — one operator registers thirty domains at once, sharing a registrar, an ASN, a DOM template hash and a registration window. Grouping by infrastructure fingerprint, with per-domain audit preserved, turns thirty human decisions into one: a single approval takes down an entire operation rather than a single site.

Beyond that, Google Safe Browsing integration for the fastest-acting real-world block, evaluation against a labeled corpus from public feeds reporting false negatives per layer — the number that actually matters, because a malicious domain discarded at the first layer dies before any human ever sees it — and cost extrapolation at enterprise volume, turning token economy from an argument into a monthly figure a security organization can budget.## Inspiration