Sentra: Hack, Fix and Prove Your AI Agent

Sentra hacks your AI agent, fixes it, and proves the fix works with real before/after scores. Powered by NVIDIA Nemotron on Nebius Token Factory.

Comment

Inspiration

AI agents can now read files, send emails and delete data. That is useful, but it also means one tricked agent can leak secrets or wreck data. Attackers don't need to hack servers anymore. They hide instructions inside a document, pretend to be the boss, or just ask the agent for its secrets. Most teams only find out after something goes wrong. We wanted a tool that finds the holes first, fixes them, and shows proof.

What it does

Sentra hacks your AI agent, fixes it, and proves the fix works.

  1. Attack: 15 real-world tricks from 5 attack types run against a target agent called Aria (an office assistant with email, file-reading and delete tools): hidden prompt injection, boss impersonation, multi-step hijack, tool-scope abuse, and system-prompt extraction.
  2. Judge: a fixed, rule-based judge reads the agent's tool-call log. It checks facts only: was an email sent to an unapproved address, was a file deleted, did the secret code leak. There is no AI opinion in the verdict.
  3. Explain: Nemotron 3 Ultra explains in plain words why each successful attack worked.
  4. Fix: Nemotron 3 Ultra writes new security rules for the agent's prompt. Sentra also adds hard code locks: an email allowlist, a "delete only if the user names the file" rule, and an output guard that removes secrets from replies.
  5. Prove: the same 15 tricks run again, and the security score is compared before and after. Then Nemotron 3 Ultra invents brand-new attacks the patch has never seen, and Sentra tests the unpatched and patched agent on them.

We also built a "Hack Aria yourself" box (type your own trick and watch the unpatched and patched agent side by side), a proof view for every attack, a downloadable report, and a "copy hardened prompt" button.

In our demo run the score went from [52] to [100], and the fresh-attack test showed [X of Y] unseen attacks working on the unpatched agent versus [X of Y] on the patched one. Scores vary slightly from run to run because the models are not deterministic.

How we built it

  • Nebius Token Factory serves every model call (OpenAI-compatible API).
  • NVIDIA Nemotron 3 Ultra 550B is the analyst: it explains attacks, writes the patch and invents fresh attacks.
  • NVIDIA Nemotron 3 Nano 30B runs Aria, the tool-calling target agent.
  • Node.js and Express run the backend. Results stream live to the page with Server-Sent Events.
  • All tools are a fake sandbox, so nothing is ever really emailed or deleted.
  • The judge has unit tests, and attacks map to the OWASP Top 10 for LLM Applications (2025): LLM01, LLM02, LLM06 and LLM07.

Challenges we ran into

  • Models sometimes returned an empty answer, which looks like a "safe" agent. We now retry, and mark the result "inconclusive" instead of counting it as a pass.
  • Scores changed between runs, so we run several tricks per attack type and score proportionally.
  • API failures must never count as "held", so they are retried and then reported as errors.
  • We wanted the "after" result to be real, so the fix includes hard code locks and not only prompt rules.

Accomplishments we're proud of

  • A full loop in one page: attack, judge, fix, re-test, with before/after numbers that come from real runs.
  • A judge based on facts in the log, not on an AI's opinion.
  • The fresh-attack test, which checks the fix against attacks it was never shown.
  • A live demo with daily usage caps and a saved real run, so the page is never empty.

What we learned

Prompt rules alone are not enough. Hard code locks (allowlists, delete checks, output guards) are what make an agent safe, and the only way to trust a fix is to test it with attacks it has not seen.

Honest limits

Aria is a deliberately weak demo agent, so there is something to fix. Sentra currently tests agents that use its sandbox tools, not any real agent through an API. Sentra attacks only its own sandbox agent and never the Nebius services.

What's next

  • Connect to any agent through an API or MCP, not only Aria
  • Multi-turn attacks
  • A model safety leaderboard that compares different models
  • CI mode, so a pull request fails if the security score drops

Built With

Share this project:

Updates

Submission history