Hire me "IF YOU CAN"

An 8-bit recruiting arena sandbox where agents attack, verify, learn, and self-correct—Fillmore runs the pipeline, Zero.xyz finds proof, and Pomerium gates every MCP action.

Comment

Inspiration

Autonomous recruiting agents read résumés, portfolios, public profiles, and candidate messages—all content an applicant can influence.

What happens when a candidate convinces an agent to skip verification or perform an action the agent was never supposed to control?

Hire Me If You Can turns that trust boundary into an observable 8-bit red-team arena. Instead of asking judges to trust an agent’s confidence, we show every attack, authorization decision, evidence artifact, recovery step, and learned defense.

What it does

Hire Me If You Can is a self-hardening autonomous recruiting loop.

  1. Fillmore creates a sandbox role, sources controlled candidates, and begins outreach.
  2. A Red Candidate agent selects a social-engineering strategy and tries to manipulate the sourcing workflow.
  3. The Sourcer believes the message and requests the protected recruiting_schedule_screen MCP tool.
  4. Pomerium denies the request because the Sourcer service identity cannot schedule interviews.
  5. A White Verifier agent diagnoses the missing evidence and asks Zero.xyz to discover an appropriate public-proof capability at runtime.
  6. The verifier invokes the selected capability within a strict budget, hashes the result, and stores a regression rule.
  7. The Hiring Controller independently revalidates that evidence and requests the exact same scheduling tool.
  8. Pomerium allows the Controller identity, and Fillmore schedules the sandbox screen.
  9. Red mutates and replays the attack. The learned regression catches it before another privileged request is attempted.

The loop repeats without manual intervention. Red carries attack effectiveness forward, White carries verified regressions forward, and the system stops only after measurable readiness requirements pass.

The central proof is intentionally simple:

outbound-sourcer → recruiting_schedule_screen → DENY

hiring-controller → recruiting_schedule_screen → ALLOW with valid evidence

The agent’s confidence never grants authority. Identity and evidence do.

How we built it

The engine is written in TypeScript 6 on Node.js 22. A deterministic coordinator owns the complete SENSE → PLAN → REQUEST → AUTHORIZE → EXECUTE → OBSERVE → LEARN cycle.

Express 5 exposes run creation, authoritative snapshots, and resumable Server-Sent Events. Zod validates every command, observation, evidence record, state transition, and presentation event.

Pomerium protects the MCP scheduling endpoint with separate Sourcer and Hiring Controller service accounts and tool-level policy. The upstream application adds defense in depth by verifying Pomerium JWT assertions, checking issuer, audience, expiry, and subject, reloading digest-bound evidence, and restricting scheduling to the sandbox calendar.

Zero.xyz is used as a capability search and activation layer—not a decorative API call. The White Verifier discovers a public-proof capability at runtime, filters results by policy and price, invokes only allowlisted capabilities, and converts the response into content-addressed evidence.

Fillmore owns the recruiting workflow: role creation, candidate sourcing, personalized outreach, pipeline events, and the final evidence-backed screening action.

The browser is only a renderer. Sponsor credentials and authority never enter the UI. It receives canonical ordered events and visualizes the entire loop as an 8-bit recruiting battle.

Challenges we ran into

The hardest problem was separating persuasion from authority. Candidate content must be useful to an agent without ever becoming a credential or policy decision.

We also had to make identity and evidence independent. Pomerium proves who may call a tool, while the application proves whether the referenced evidence is valid.

Finally, the demo needed to remain observable and recoverable. We built ordered event streams, duplicate rejection, snapshot recovery, persistent learning memory, bounded budgets, and explicit fake, recorded, hybrid, and live modes.

Accomplishments that we're proud of

  • A complete eight-turn autonomous attack, verification, recovery, and learning episode
  • Persistent multi-episode Red and White memory
  • Readiness-based termination instead of a hard-coded number of loops
  • The same MCP tool visibly denied and allowed under different identities
  • Runtime capability discovery through Zero.xyz with policy and budget controls
  • Evidence-backed recruiting actions through Fillmore
  • A replay attack blocked by a defense learned earlier in the run
  • Zero unauthorized actions and zero false positives in the controlled evaluation
  • A resumable, event-driven 8-bit interface
  • 82 passing tests across contracts, agents, adapters, runtime, HTTP, UI, accessibility, and failure boundaries

What we learned

Autonomy does not mean giving an agent unlimited tools. Strong autonomy comes from bounded actions, structured observations, inspectable memory, measurable stop conditions, and explicit authority.

We also learned that agent identity and factual evidence solve different problems. A trusted identity can still be wrong, and valid evidence should not give every agent permission to act.

The most trustworthy agent is not the one that sounds most confident. It is the one that can show why it acted, what authorized it, what evidence it used, and what it learned afterward.

What's next

Next we will expand the mutation catalog, add more Zero.xyz verification capabilities, strengthen cross-role evaluations, and turn the arena into a reusable benchmark for testing consequential agent workflows beyond recruiting.

Built With

Share this project:

Updates