-
-
Github project tree
-
Attack simultion matrix
Inspiration
Autonomous AI agents running frameworks like LangChain, AutoGPT, or crewAI are routinely given execution authority over local bash shells, system files, and databases. Cloud-based LLM evaluators introduce 1,000ms–3,000ms latency and fail completely offline, while basic regex filters are easily bypassed using command obfuscation (r\m -rf, Base64 decoding, SQL comment splicing). We built ShieldAgent to provide zero-latency, local-first hardware boundary protection.
What it does
ShieldAgent acts as an ultra-fast local enforcement proxy running between an AI agent and its tool-execution environment:
- Tool-Call Interception: Inspects every bash command and database query in ~1.1ms.
- Lexical & AST De-obfuscation: Recursively unwraps Base64 payloads, strips shell escapes, and parses SQL tokens before security checks run.
- 3-Strike Kill-Switch: Tracks threat scores across a rolling 60-second window and immediately trips a hardware-local quarantine kill-switch upon a third malicious violation.
- Resilient Audit Trail: Persists all policy verdicts and timestamps into a crash-proof SQLite WAL database.
How we built it
- Backend: FastAPI running asynchronously on Uvicorn.
- Parsing Engine: Python shlex, ast, and standard library decoders to keep memory footprint minimal.
- Database: SQLite3 in Write-Ahead Logging (WAL) mode for lock-free parallel auditing.
- Testing Suite: Custom attack simulator testing prompt injections, SQL manipulation, and chained destructive bash operations.
Challenges we ran into
Achieving sub-2ms processing on low-resource ARM hardware while parsing complex payload evasions, and building a concurrency-safe threat tracker that prevents race conditions during high-volume tool execution.
Accomplishments that we're proud of
- Sub-2ms Deterministic Latency: Achieved a ~1.1ms average policy enforcement latency running directly on low-resource ARM mobile/edge hardware, without relying on costly external LLM APIs.
- Resilient Lexical De-obfuscation: Built a robust normalization layer using Python's AST and shell lexers that reliably detects evasive payloads—such as nested Base64 strings, wildcard splitting, and command chaining—before execution.
- 100% Mobile Development Lifecycle: Engineered, debugged, tested, and containerized the entire system (FastAPI server, SQLite WAL layer, and synthetic attack simulator) entirely within an Android Termux environment.
- Deterministic Isolation: Created a rock-solid, concurrency-safe 3-strike state machine that instantly halts rogue agent processes the moment malicious intent thresholds are breached.
What we learned
- Edge vs Cloud Tradeoffs in AI Security: Relying on secondary LLM calls for guardrails creates unacceptable latency and single-point-of-failure risks. Deterministic AST parsing and lexical normalization provide vastly superior speed and zero false-bypass consistency for tool-execution security.
- Payload Evasion Mechanics: Gained deep insight into real-world command obfuscation techniques—such as POSIX shell escaping, recursive Base64 encoding, and SQL comment splicing—and how standard regex-based filters fail against them without proper tokenization.
- Concurrency and Database Optimization: Learned how to safely track thread-isolated state machines in asynchronous FastAPI apps, and how configuring SQLite in Write-Ahead Logging (WAL) mode prevents database lock contention under rapid simulation.
What's next for ShieldAgent
- Hardware-Level eBPF Network Isolation: Moving beyond application-layer proxying to implement lightweight eBPF socket filters in the Linux kernel, dropping outbound network traffic the millisecond an agent is quarantined.
- Native Rust/C FFI: Porting the lexical parser to Rust to push latency into sub-microsecond ranges.
- LangChain & AutoGPT SDKs: Packaging ShieldAgent into drop-in Python and TypeScript client decorators.
