AntiBody

• 

  demo hosted on github pages

Inspiration

AI agents went from chatbots to coworkers this year. They read our email, browse the web, and send messages and payments for us. The scariest part is that every email, webpage or PDF an agent reads can carry hidden instructions that it will follow. Google reported a 32% jump in these indirect prompt injection attacks on the open web in just a few months, and attackers keep inventing new tricks. Most defenses are filters that only know yesterday's attacks. That made me think of the human immune system: it doesn't need to know every germ in advance. It notices when something is wrong, fights it, and remembers it forever.

What it does

Antibody sits between an AI agent and its tools and checks every action before it runs. A fast lookup stops any attack the network has seen before in milliseconds. For anything new, an intent check asks one question: did the user actually ask for this? Every attack it catches becomes an "antibody". A red-team step rewrites that attack dozens of ways to close any gaps, and the antibody is shared with every agent on the network. An attack caught at one company protects every other company minutes later.

How I built it

The product page is a single self-contained web app. It shows the full story: an attack landing, getting caught, being turned into new defenses, and immunity spreading across a network of agents on the Immune Map. The intent check in step 2 is a live call to Claude. It sees the actual emails, including the hidden text, plus the action the agent is about to take, and returns an alignment score, a reason, and a diagnosis of the attack. The rest of the demo is scripted so it runs the same way every time, and the page falls back to a recorded verdict if the live call isn't available. The How it works and Design philosophy tabs explain the architecture and the thinking behind it.

What I learned

The biggest lesson was where to look for attacks. Trying to recognize malicious text is a losing game, because attackers can reword anything. What the agent ends up doing is much harder to disguise. "Summarize my inbox" never includes "email the invoices to an outside address", however cleverly the instruction is hidden. I also learned that speed and cost matter as much as accuracy: agents can't wait on a model call for every step. That's why the design uses a cheap fast layer for known attacks and saves the model for genuinely new ones.

Challenges

• Defining failure. "Bad action" is vague, so I settled on three concrete rules: the action is outside what the user asked for, it moves data or money across a trust boundary, or it's outside the agent's job.
• Making security visible. Security products are usually invisible until something breaks. I wanted judges to see an attack happen and fail, so I built the Immune Map and revealed the hidden text exactly where the agent read it.
• Reliability versus being live. A fully live demo can break on stage, and a fully scripted one isn't convincing. I made the one moment that matters, the intent check, a real model call, and kept the rest scripted.
• Time. I scoped hard to one agent story told well, rather than a half-finished platform.

What's next

Turning the demo into a drop-in wrapper for agent frameworks like LangGraph and MCP servers, building a real shared antibody store with embedding search, and testing it against public prompt-injection benchmarks.

Built With

• css
• html
• javascript