Inspiration

AI coding agents are becoming increasingly autonomous, but greater autonomy comes with greater risks. They can hallucinate file paths, install non-existent packages, execute unsafe commands, fall victim to prompt injection, or lose track of their original objectives.

We realized that while AI agents are getting smarter, they still need someone watching their actions. This inspired us to build Burto — a real-time security guard that keeps AI coding agents safe, reliable, and aligned with developer intent.

What it does

Burto acts as an intelligent security layer between AI coding agents and their tools, intercepting and evaluating actions before execution.

Its key capabilities include:

Hallucination Interceptor: Detects non-existent file paths, hallucinated packages, and invalid CLI flags before they cause failures.
Prompt Injection Protection: Scans terminal commands for malicious instructions, data exfiltration attempts, and destructive operations.
LLM-Powered Evaluator: Uses contextual reasoning to classify tool calls as ALLOW, STEER, or BLOCK.
Drift Detection: Identifies failure spirals, repetitive actions, tool cycling, and silent goal drift.
Self-Correction: Injects contextual feedback to help agents recover and return to their intended workflow.
Learning Loop: Learns from developer-approved decisions using few-shot examples to improve future evaluations.
Stop Hook: Prevents an agent from ending its session while unresolved drift requires attention.

All of this works without requiring developers to explicitly declare their tasks.

How we built it

We built Burto using a combination of Python, FastAPI, LLMs, and agent lifecycle hooks.

Our architecture consists of:

FastAPI: Handles incoming agent hook events and serves the dashboard.
PreToolUse Hooks: Intercept tool calls before execution.
PostToolUse Hooks: Monitor agent behavior and detect session-level drift.
Stop Hooks: Perform a final alignment check before session termination.
Nebius Qwen3-30B-A3B: Powers contextual tool-call evaluation and drift explanations.
Nebius Nemotron-3.5-Lightning: Provides an additional prompt-injection security layer.
SQLite: Stores decisions, hallucinations, drift events, and developer-approved training examples.
HTML/CSS: Powers a real-time dashboard for monitoring agent sessions, security decisions, and drift events.
MCP Server: Exposes Burto functionality through tools that agents can interact with.

We also implemented a universal hook dispatcher to integrate Burto into AI coding workflows.

Challenges we ran into

One of our biggest challenges was detecting hallucinations without interrupting legitimate development workflows. Distinguishing between an incorrect file path and a valid new file creation required careful contextual checks.

Other challenges included:

Building a security layer that evaluates actions without introducing significant execution delays.
Detecting sophisticated prompt injection attempts embedded within terminal commands.
Identifying goal drift across multiple tool calls rather than evaluating each action independently.
Designing recovery-based suppression mechanisms to avoid repeatedly flagging the same issue.
Integrating multiple LLM evaluators while keeping the system responsive and reliable.
Making the system work without requiring developers to manually declare their intended tasks.

Balancing security, accuracy, and developer experience was one of our most important engineering challenges.

Accomplishments that we're proud of

Built a unified security layer that protects AI coding agents at multiple stages of their lifecycle.
Implemented three categories of hallucination detection before tool execution.
Developed a parallel LLM-powered prompt injection detection mechanism.
Created four session-level drift detection rules with recovery-based suppression.
Built a contextual LLM evaluator with ALLOW, STEER, and BLOCK decisions.
Implemented a developer feedback loop that turns approved decisions into future evaluation examples.
Developed a monitoring dashboard that brings security decisions, hallucinations, and drift events into one place.
Enabled agents to self-correct through contextual feedback without requiring constant human intervention.

Most importantly, we built Burto to address a growing problem in the AI development ecosystem: AI agents need not just intelligence, but accountability.

What we learned

Building Burto taught us that securing autonomous AI systems requires more than detecting malicious commands.

We learned the importance of combining deterministic heuristics with contextual LLM reasoning, monitoring behavior across entire sessions, and designing feedback mechanisms that help agents recover rather than simply stopping them.

We also gained hands-on experience with AI agent lifecycle hooks, asynchronous security evaluation, MCP integration, prompt injection defense, and LLM-powered decision systems.

One key takeaway was that an AI agent's individual actions may appear reasonable while its overall workflow gradually moves away from the original objective. Detecting this requires continuous contextual monitoring.

What's next for Burto

We envision Burto becoming a universal trust and security layer for autonomous AI agents.

Our future roadmap includes:

Expanding integrations across more AI coding agents and development environments.
Developing more sophisticated prompt injection and data exfiltration detection.
Improving evaluation speed through optimized and adaptive security pipelines.
Introducing customizable security policies based on developer preferences.
Enhancing the dashboard with deeper analytics, session comparisons, and security insights.
Building stronger long-term learning mechanisms from developer feedback.
Exploring support for multi-agent systems and coordinated autonomous workflows.

Our ultimate vision is simple: Let AI agents build freely, while Burto makes sure they do so safely, securely, and with purpose.