Mirage-Node

• 

  architect

Inspiration

Recently, we saw how autonomous AI was weaponized to breach major platforms like Hugging Face. Attackers are evolving, utilizing agentic workflows to probe and exploit enterprise networks. However, traditional defense mechanisms haven't changed: a classic firewall or IDS blocks a malicious request and simply throws away the story. It learns nothing.

We realized that if attackers are using agentic AI, defenders must do the same. We built Mirage-Node—not just to block attacks, but to actively deceive, study, and remember them.

What it does

Mirage-Node is an agentic deception gateway designed specifically for the Fortified Enterprise Fleet track. Instead of just dropping malicious packets, Mirage-Node acts as a highly intelligent traffic router. Normal users are routed directly to your production servers with zero latency. But when our gateway detects malicious traffic (like an SQL injection), it silently diverts the attacker into a dynamic, hardened honeypot.

What makes it special is the Agentic Brain:

• Persona Forge: Our Architect agent uses Google's Gemini AI to forge a unique, convincing personality for the decoy container on the fly.
• History-Adapted Deception: If the attacker has probed us before, Gemini reads their past behavior from our database and generates a decoy that subtly "recognizes" or adapts to their specific attack vectors.
• Campaign Memory Bank: Mirage-Node tracks attackers across days or weeks using fingerprint hashes (never raw PII), storing their entire forensic campaign in the cloud.

How we built it

We built a true Hybrid Architecture:

• The Gateway: A blazing-fast Node.js edge router handles incoming HTTP traffic, pre-scanning payloads before they even reach an LLM. The Brain: A Python Multi-Agent System featuring the Sentinel (for threat classification and blacklisting) and the Architect (for dynamic decoy generation).
• The Cloud Engine: We deployed the gateway to Google Cloud Run for serverless autoscaling in the Jakarta region. To ensure our agents' memory survives container restarts, the Campaign Ledger hydrates directly from Google Cloud Firestore.
• The AI Matrix: We utilized Gemini (3.5-flash, 3.6, and 3.7). To prevent the pipeline from breaking during 429 Rate Limit errors, we engineered a Quota-aware Model Matrix—a failover system that automatically cycles through 6 key-model combinations.

Challenges we ran into

Maintaining state and context across weeks of asynchronous operations in a stateless serverless environment (Cloud Run) was incredibly difficult. If the container spins down, the agent forgets the attacker. We solved this by architecting the Campaign Ledger to seamlessly sync and hydrate from Firestore upon boot, ensuring true persistent agentic memory. Additionally, handling LLM hallucinations in a security context is dangerous. We built a strict local validator that sanitizes Gemini's output (preventing CRLF injection and bounding JSON depth) before passing the forged persona to the decoy container.

Accomplishments that we're proud of

• Zero-Downtime Agent Registry: We successfully exposed a cross-department agent catalog (/_mirage/agents) mapped precisely to Google's GEAP vocabulary, satisfying the core track requirements.
• Engineering Discipline: We built this with 51 unit tests, a 7-gate integration suite, secret-scanning CI gates, and a robust failover architecture that gracefully degrades to deterministic heuristics if the AI matrix is exhausted.

What we learned

We learned that while Large Language Models are phenomenal at generating creative deception (personas), they require extremely strict deterministic guardrails when interacting with raw network protocols. We also learned how to effectively bridge the gap between fast, stateless edge routing and slow, stateful agentic reasoning using Google Cloud's serverless ecosystem.

What's next for Mirage-Node

We plan to introduce JA3/JA4 TLS fingerprinting at the proxy layer to track sophisticated botnets even when they rotate IPs. Furthermore, we aim to integrate OpenTelemetry to export our agents' reasoning-chain spans directly into Google Cloud Trace for enterprise-grade observability.

Built With

• docker
• gemini
• google-cloud
• google-cloud-firestore
• google-cloud-run
• node.js
• python