Guardian

surreal db
daytona
arize

Summary

Guardian is an AI scam shield for families. When a stranger texts Mom, Guardian checks the link so she never has to open it, calls the real family member before any money moves, and then calls her in her own language (Telugu, English or Spanish), starting with a phrase only the family knows. Guardian can act in seconds, but it can never approve a single dollar. Only family can.

Inspiration

This started in our group chat. One of us posted a screenshot his mom had forwarded him: a text saying her bank account was blocked and she had 24 hours to "verify." Within a few minutes, everyone had one. A fake toll bill. A package that "couldn't be delivered." A message that started with "Hi Mom, it's me, I dropped my phone in water."

None of our parents fell for those particular ones. But every one of them told us the same thing: "I wasn't sure, so I waited until I could ask you." Sometimes that took hours, because we were at work, or asleep, or in a different time zone. The scammers know this. Their messages are written to make you act before you can ask anyone.

My mom reads English, but she thinks in Telugu. When she's scared, the warnings in her banking app don't help much. What helps is hearing a familiar voice say, in her own language, "Amma, don't touch that, it's fake."

We can't always be the one who picks up. So we built Guardian to do it for us: it checks the link before she ever has to, calls her in her language with a phrase only our family uses, and makes sure no money moves until one of us says yes.

Scammers count on her being alone at that moment. We built this so she isn't.

The problem and its impact

In 2025, Americans over 60 reported more than \$7.7 billion in fraud losses to the FBI, and phishing texts and spoofed calls were their most common complaint (about 48,000 reports).
These scams all work the same way. A message creates panic: your account is locked, your son is in trouble, your computer has a virus. It arrives when she's alone, and it pushes her to act before she can check with anyone.
Most protection today is an English-only warning banner. It still leaves the scary decision to the person being targeted.

Guardian fills that gap without asking her to learn anything new. Her phone forwards texts from unknown numbers on its own, or she can simply tell Guardian what happened on WhatsApp, by text or voice note, in her own words.

What it does

Guardian handles the four scams our parents actually get. Every case follows the same seven steps: Received → Checked → Verdict → Call → Teach-back → Help note → Remembered.

The fake bank link. Guardian opens the link so she doesn't have to. A cloud browser loads it the way her phone would, and the page is taken apart inside a fresh Daytona sandbox that has no internet access. Guardian sees what the page was really after (her password, her card number, a hidden download) and checks how new the website is and whether it's pretending to be her bank.
"Mom, it's me." When someone claims to be her son, Guardian doesn't guess. It calls the real son on the number the family saved and asks him one question. The scammer controls the number that texted her, not the one Guardian calls back.
"I need money today." Any request above the family's limit is locked. It stays locked until a second family member presses and holds a button on their own phone. Guardian can't approve it, a spoken "yes" doesn't count, and the lock never times out.
The fake "Microsoft" call. She tells Guardian about the call in her own words. If she was asked to install a remote-access app, call back a support number or buy gift cards, Guardian locks the money and brings in her son.

Every scam ends the same way. Guardian calls her in her language, says the family phrase first so she knows it's really family, gives two simple reasons the message was fake, and asks her what she'll do next time (teach-back). Then it writes a short help note, in text and audio, that she can forward to her friends. Finally, it remembers the scam, so the same link, sender or story is caught instantly next time.

How we built it

Architecture

Mom's phone ──(auto-forward / WhatsApp text or voice)──► Twilio ──► FastAPI case engine (pipeline.py)
                                                                       │
   ┌──────────────┬──────────────┬─────────────────────┬───────────────┼────────────────┬───────────────┐
   ▼              ▼              ▼                     ▼               ▼                ▼               ▼
 Bedrock +      Anchor         Daytona             Rules engine    ElevenLabs       SurrealDB        Arize AX
 Textract +     cloud          sandbox,            (rules.py,      voice agents     Agent Memory     traces, live
 Titan          browser        no network,         every reason    (te/en/es,       + trust graph,   checks, human
 (read only)    (mobile view)  kept per case       cites a rule)   callback, key)   fingerprints     labels
                                                                       │
                                                     Server-Sent Events (/events)
                                                                       ▼
                                     Next.js 15 web app: /stage · /family · /phone

Key components

Backend (Python, FastAPI). pipeline.py runs each case from start to finish. rules.py decides the verdict. detonate.py and quarantine_job.py handle the sandbox. calls.py places the calls and streams captions. memory.py and graph.py hold what Guardian remembers. live_evals.py runs safety checks on every case, and scrub.py strips personal details before any AI model or trace sees the text.
The AI reads, the rules decide. The language model only pulls out facts: who is claiming to be whom, and what they want. The verdict comes from fixed rules with weights we can explain:

$$ \text{score} = \max\Big(0,\ \sum_{r \in \text{fired}} w_r\Big), \qquad \text{verdict} = \begin{cases} \text{safe} & \text{score} < 30\ \text{suspicious} & 30 \le \text{score} < 60\ \text{scam} & \text{score} \ge 60 \end{cases} $$

Every reason Mom hears on the call points back to the rule that fired.

Frontend (Next.js 15, TypeScript). One live event stream feeds every screen. /stage shows three things side by side: Mom's phone, Guardian's desk (the seven steps as they happen, the verdict stamp and the sandbox evidence) and her son's phone. /family is the son's page: family phrases, languages, the money limit, the memory graph and today's cases.
Data. A labeled test set of 47 family messages; 68 scam families in shared memory, 30 of them distilled from public datasets; 900 known smishing patterns for matching reworded texts; and a SurrealDB graph that links cases through shared phone numbers, domains and wallets.

Sponsor tools and how we integrated them

Sponsor	How Guardian uses it
ElevenLabs	Five voice agents: warning calls in Telugu, English and Spanish that open with the family phrase and end with a teach-back, the callback to the real relative, and the second-key call. Scribe transcribes her WhatsApp voice notes, and the help note is spoken aloud for her friends.
Twilio	Her WhatsApp line in and out, the family's phone number, and Lookup on every stranger. A "bank" texting from an internet phone line becomes one of the reasons she hears.
Daytona	Every link is parsed inside a fresh sandbox, built from a prebuilt snapshot, with no network. Each sandbox is named and labelled for its case and kept stopped for the audit. The desk shows what the page tried to do: password fields, hidden frames, outside scripts, downloads.
Anchor	The cloud browser that opens the link the way her phone would (mobile screen, touch), follows the redirects, and streams a live view and screenshot, far away from anyone's phone.
SurrealDB Agent Memory	Typed facts in two scopes: one for the family, one for shared scam knowledge (68 scam families, 30 distilled from public datasets). Guardian remembers verdicts and her own teach-back answers, so her son can ask how she's doing.
Arize AX	Every case is a trace with three live checks: every reason cites a rule, nothing Guardian says asks for a secret, and the language matches. Her son's press-and-hold and her teach-back answers are written back as human labels. Two experiments: our 47 family messages and a public smishing benchmark.
AWS	Bedrock Claude pulls signals out of each message (it only reads; the rules decide). Titan embeddings match texts against 900 known smishing patterns, and Textract reads the photos and screenshots she forwards.

Safeguards

Guardian can't move money. The only way to approve a payment is a press-and-hold on a family member's own phone. A spoken "yes" doesn't count, and the lock never times out.
Guardian never asks for secrets. It never asks for codes, passwords, card numbers or payments. A live Arize check and our tests confirm this on every single case.
Her privacy comes first. Personal details are scrubbed before any AI model or trace sees the message.
Dangerous pages stay contained. Links are opened in a cloud browser and taken apart in a sandbox with no internet, which is then stopped and kept for the audit. During the demo, the only page we ever open is our own fictional bank site.
Going live is a deliberate choice. Demo and live modes are separate, switching to live takes two clicks within three seconds, and a text budget caps how many real messages go out.
Nothing falls over. Every sponsor service has a mock stand-in, so a missing key or an outage never breaks a case.

Results

92% of scams caught with zero false alarms on our labeled set of 47 family messages, mostly English and Spanish with a first Telugu case.
Her first warning call starts about 8 seconds after the text arrives.
37 automated tests pass, covering the rules, memory, calls, the sandbox, the Telugu flow and the safety guards.

Challenges we ran into

A sandbox with no internet. Our Daytona plan doesn't let sandboxes reach the web. So we split the job: the cloud browser fetches the page, and the sandbox only takes it apart, completely offline. It turned out safer than our original plan.
Real phones are messy. US carriers blocked our outgoing texts until 10DLC registration cleared, so we moved Guardian's replies to WhatsApp. Carriers also split long texts into pieces, so we stitch together fragments from the same sender.
Voice timing. ElevenLabs only releases the transcript after a call ends. We had to track the call status to show "connected" live, and clean up voice tags before showing captions.
Sounding like family in three languages. Getting natural Telugu and Spanish calls that still open with the family phrase and give real reasons took many rounds of prompt tuning and testing.
Small front-end surprises. One CSS setting silently froze our animations in Chrome, and we had to rebuild that part of the layout.

What we learned

For an agent that touches people's money, let the AI read and let simple rules decide. Every decision can then be explained and tested.
A human "second key" is a simple, powerful way to keep an agent from ever being tricked into paying.
Safety checks belong inside the product. Running them live on every case lets us show judges, and families, that Guardian behaves.
Designing for an older parent who thinks in another language changes everything: no app to learn, a voice she trusts, and a phrase that proves it's really family.

What's next

A number she can call any time to ask Guardian about a message, in her own voice.
More languages for more families, and a much larger Telugu test set.
Sharing anonymous scam fingerprints between families, so one family's scare protects the whole community.