Medusa Pinch — Zero-Trust Agent Security Harness

• 

  Test Of Fraudulent Injection

Medusa Pinch — Zero-Trust Agent Security Harness

Stop trusting AI agents with your customers' money. Start proving they can't misbehave — with a guardrail, a permission gate, and a tamper-evident audit trail that make any autonomous payment agent safe enough to deploy.

Inspiration Every "AI agent for fintech" pitch we've seen makes the same mistake: it sells the automation and treats security as an afterthought — a try/catch block bolted on before the demo. But the moment an agent touches money, security is the product. A CTO doesn't lie awake worrying whether your dunning email is well-written. They lie awake worrying about the one prompt-injected memo field that convinces an autonomous agent to issue a fraudulent refund. So we flipped the brief. Instead of building a payment-recovery agent and wrapping it in security, we built a zero-trust security harness and used payment recovery as the proof case. The agent is the demo. The harness is the business. What It Does Medusa Pinch ingests a payment-provider webhook (failed charge, expired card, overdue invoice) and runs it through a multi-agent pipeline that decides — and executes — a remediation action. Every step is wrapped in a security control a fintech CTO would actually sign off on: Stage What happens Input Guardrail Screens the untrusted event for prompt-injection, jailbreak, and financial-manipulation patterns before any agent runs Diagnose A bounded LLM classifies the failure into a strict, typed object — it never decides the action Decide A deterministic rule engine (config-driven, not code) picks the remediation — no LLM ever governs what happens to money Draft A free LLM writes the customer-facing message Output Auditor Scans the generated text for leaked secrets or unauthorized promises before it can leave the system Permission Gate High-value or sensitive actions are held for human sign-off — least privilege on every write Execute A fully deterministic, LLM-free step performs the (simulated) action Audit Ledger Every stage is written to a hash-chained log — tamper with one historical entry and the chain breaks instantly, visibly A live dashboard streams the whole pipeline in real time: green for clean runs, amber for degraded (fallback) runs, red for blocked attacks. How We Built It Stack: Python, FastAPI, Pydantic, PyYAML, SQLite, vanilla HTML/CSS/JS dashboard over WebSocket, optional Anthropic Claude API. The core design decision: an LLM is never allowed to decide what happens to a customer's money. The diagnostic agent is a bounded model — it can only emit a validated Diagnosis object (Pydantic). The actual remediation is chosen by a deterministic rule engine reading risk_rules.yaml. To redeploy the harness for a new client, you edit the YAML, not the Python — the risk logic is data, not code. Guardrail + auditor: a deterministic pattern screen (not another LLM) checks incoming event text for injection signatures — instruction-override phrasing, role-hijack attempts, delimiter injection, credential-fishing patterns — and scores it. The output auditor runs the same discipline in reverse: it blocks leaked secrets and catches a generated message that promises something the rule engine never authorized (e.g. a refund the action didn't approve). Deterministic fallback, proven, not simulated: the entire pipeline runs correctly with zero API key set. If the LLM is unavailable, times out, or a safety classifier declines, every agent falls back to a deterministic path. This isn't a demo shortcut — it's Pillar 4 working for real, every time we tested it. Audit ledger: each pipeline stage is appended to a SQLite table where every row's hash is computed over the previous row's hash plus its own content — a hash chain, not a blockchain. verify_chain() recomputes the whole chain and reports the exact row where tampering occurred. Adversarial test suite: a fixed battery of ten known hostile payloads (five input-side, five output-side) run against the guardrail and auditor. It's scriptable, deterministic, and exits non-zero on any failure — built to gate a CI pipeline, not to perform "the AI attacking itself" theater. Challenges We Ran Into Delimiter injection slipped through initially. Our first guardrail pass caught instruction-override and role-hijack phrasing but missed a bare fake-tag attack (</system>...<system>) because its weight was tuned too low. Running the adversarial suite caught it immediately — 9/10 instead of 10/10 — and a one-line weight adjustment closed the gap. That's exactly the point of having a runnable test suite: it caught our own blind spot before a demo would have. Keeping the LLM honest without trusting it. It would have been easy to let the diagnostic agent also decide the remediation — faster to build, worse to sell. We had to resist collapsing "classify" and "decide" into one model call, because the moment they merge, you no longer have a deterministic core to point to. Making the fallback real, not decorative. It's tempting to write a fallback path that only exists on paper. We tested the entire pipeline with ANTHROPIC_API_KEY unset and confirmed every stage — diagnosis, drafting, decisioning — completes correctly in pure deterministic mode. If it hadn't, the whole "resilience" pitch would have been fiction. Accomplishments We're Proud Of ✅ 10/10 adversarial vectors blocked, verified by a standalone, CI-gatable script ✅ Runs end-to-end with zero API key — the deterministic fallback isn't a slide, it's tested behavior ✅ Tamper-evident audit ledger, proven live — we manually edited a historical row mid-demo and watched verify_chain() catch it at the exact broken sequence ✅ An LLM never decides what happens to money — the rule engine is config-driven (YAML), swappable per client without touching code ✅ A live NOC-style dashboard, not a slide deck — the attack, the block, and the ledger are all visible in real time over WebSocket What We Learned Security-for-agents isn't a wrapper you add after the demo works — it changes the architecture. The single highest-leverage decision was separating classification (bounded LLM) from decision (deterministic rule engine): once that split exists, every other pillar — the guardrail, the gate, the ledger — has something concrete to protect. We also learned that a fallback path only earns trust once you've actually run the system without the thing it's supposed to survive losing. What's Next for Medusa Pinch Near-term: Replace the simulated executor with real least-privilege provider API calls, each still gated by the permission layer Signed human approvals written into the ledger (who approved what, when — cryptographically) Productization: Multi-tenant context isolation, so no LLM cache is ever shared across a client's sub-accounts Package the four pillars as an installable middleware (pip install medusa-harness) — a drop-in security layer for any agent Conductor, configured entirely via YAML This project is the proof case. The product is the harness — a layer any team building autonomous agents can wrap around their own pipeline to make it deployable in front of a CTO who actually asks hard questions. Built With python fastapi pydantic sqlite yaml anthropic-claude websocket html5 javascript

Built With

• anthropic-claude
• fastapi
• html5
• javascript
• pydantic
• python
• sqlite
• websocket
• yaml