Track: Cybersecurity and Fraud Detection · Generative AI & Responsible AI
Inspiration
AI agents increasingly share long-term memory, and that memory is a new attack surface. One poisoned memory can make every agent that trusts it move money, book travel, or send email for an attacker. The industry focuses on detecting bad writes. Nobody gives you a way to undo the damage once they get through. We built that: Ctrl+Z for agent memory.
What it does
ctrlz is a recovery console for poisoned agent memory. In our demo, a travel concierge agent and a finance agent share one memory store. An attacker posing as the travel desk plants a note that redirects Alice's travel spend to a card they control. The agent trusts it and books a flight. With one click, ctrlz:
- Traces the full blast radius through a causal lineage graph (message → memory → action → derived memory).
- Quarantines every tainted record in a single atomic transaction and revokes the poisoned memory's embedding, so paraphrased re-attacks are caught.
- Plans a clean replay first, so correct effects are kept instead of cancelled and redone.
- Compensates the rest exactly once: refunds, payment recalls, correction emails.
- Replays affected requests without the poisoned memory.
- Hardens itself: it evolves the write guardrail and ships a new rule set only if it blocks more attacks while allowing every legitimate write on both a dev split and a held-out split.
Everything is visible live: write log, lineage graph, side-effect ledger, incident timeline, guardrail versions, and every database operation as it runs.
How we built it
A TypeScript/Next.js app on MongoDB Atlas.
$graphLookuptraces causal lineage across agents.- Multi-document transactions handle atomic quarantine.
- Unique indexes and checkpoints make compensation exactly-once and crash-resumable.
- Hybrid retrieval combines vector and full-text search, pre-filtered so quarantined or low-trust memory is never served.
- Stripe test mode handles real charges and refunds. Hotel, invoice and email effects are simulated.
It runs with zero external AI keys (deterministic embedder and rule-based planning), and Voyage AI or any OpenAI-compatible LLM can be plugged in.
Validation and results
- End-to-end recovery verified: the full attack → trace → quarantine → refund → clean replay → re-attack cycle runs in under a minute, and a paraphrased re-attack is held automatically.
- MPBench evaluation: we scored the write guardrail on the MPBench memory-poisoning benchmark, 3,239 attack and 2,999 benign records. It ran at a 1.47% false-positive rate, so legitimate memory writes almost never get blocked, while it caught 15.53% of attacks at the write stage.
- Defense in depth: ctrlz is the recovery layer that complements any detector. Whatever gets past detection can still be traced and undone.
Challenges
Making recovery safe to repeat: compensating exactly once, keeping effects that were already correct, and resuming cleanly after an interruption.
What we learned
Detection alone isn't enough for agent memory. You need lineage, so you know exactly what a bad memory touched and can undo only that.
What's next
Authenticated agent identities, more effect adapters beyond Stripe, and pairing ctrlz with dedicated injection detectors for a full prevent-and-recover stack.
Team contributions
- Manvender Singh: [architecture, recovery workflow, guardrail evaluation, MPBench benchmarking, dashboard]
- [Teammate]: [role]
Links
- Live demo: https://ctrlz-mu.vercel.app/console
- Code: https://github.com/manvendersingh21/ctrlz
- Video: https://youtu.be/j7PaFIuqaNE
Built With
- docker
- mongodb-atlas
- openai-compatible-llm
- stripe-(test-mode)
- typescript
- vercel
- voyage-ai
