The Gate for Climate Agents

Inspiration

Climate platforms increasingly run agents over untrusted inputs: sensor feeds scraped from vendor portals, public research reports, CSVs from data marketplaces. An agent that triggers grid actions, files regulatory reports or moves carbon-credit records is one poisoned report away from acting on injected instructions.

What it does

The prompt-injection gatekeeper pattern sits at the tool boundary: every tool call the agent proposes (write a sensor reading, adjust a control setpoint, update an emissions record) passes seven typed yes/no questions first. Thresholds turn the answers into PROCEED (execute and audit), CONFIRM (hold for a human operator) or DENY (block and record a security event). Anything risky or ambiguous holds for a person instead of executing.

How we built it

Tools are wrapped in a GatedTool that is the only route from the LLM's tool choice to a real function, and the gate fails CLOSED to CONFIRM on any decider failure. A red-team suite of nine attack classes (obvious injection, indirect injection through documents, malicious tool arguments, unauthorized and premature actions, and more) runs live against the decider and writes evaluation_results.json with detection rate, false positives and negatives, and latency: about 115 ms per typed question, and at 0.9+ confidence it is right roughly 95% of the time, so low confidence degrades to a human confirmation instead of a guess.

The climate build

The climate-data framing (sensor ingest, control actions, emissions records), the operator-confirmation flow and the demo showing an indirect injection arriving through a public report are the build of this hackathon; the gate itself and its red-team suite are shipped and tested in the repo.

Challenges

Keeping every figure honest: all numbers come from the repo's README and evaluation results, nothing invented.

Built With

• python