TRUSTFORGE ZERO

An autonomous immune system for AI agent fleets that attacks, detects, repairs, re-tests, and certifies agents before they earn the right to act.

Comment

Inspiration

AI agents are rapidly moving from assistants that recommend actions to autonomous systems that can use tools, access data, delegate work, and execute real-world operations.

That creates a new problem: how can an enterprise know that an autonomous agent is actually safe enough to act?

Traditional security testing is often static and performed before deployment. Agentic systems are different. Their behavior depends on prompts, tools, memory, permissions, delegation paths, and runtime state. A system that was safe yesterday may become unsafe after a tool, policy, or context changes.

TRUSTFORGE ZERO was built around one principle:

No autonomous agent should earn the right to act until it survives adversarial testing and produces verifiable evidence of its safety.

Our goal was to build an autonomous immune system for AI agent fleets — one that can attack, diagnose, repair, re-test, and certify agents before granting them authority.

What it does

TRUSTFORGE ZERO executes an autonomous security certification lifecycle:

Discover → Attack → Diagnose → Repair → Re-Attack → Attest → Certify

A Governor coordinates a specialized agent mesh and deterministic security controls.

The system evaluates 10 defensive attack vectors, including:

  • Indirect prompt injection
  • Hallucination conflicts
  • No-progress loops
  • High-risk actions requiring human approval
  • Identity and privilege abuse
  • Tool-schema poisoning
  • Memory poisoning
  • Sensitive-data egress
  • Cascading delegation
  • Tool supply-chain drift

When weaknesses are detected, TRUSTFORGE ZERO applies least-privilege hardening inside its controlled environment and then replays the same security controls.

Certification is fail-closed: if required live AI evidence, recovery evidence, provenance, or security controls cannot be verified, the agent does not receive authorization.

Successful runs produce a Trust Passport derived from executed evidence rather than a manually assigned score.

How we built it

TRUSTFORGE ZERO uses a hybrid architecture combining AI reasoning with deterministic security enforcement.

The system integrates:

  • Gemini for live forensic/security reasoning
  • Google Agent Development Kit (ADK) for agentic orchestration
  • A specialized multi-agent architecture coordinated by the TRUSTFORGE Governor
  • Deterministic policy controls for reproducible security decisions
  • Server-Sent Events (SSE) for real-time execution telemetry
  • SHA-256 hash-chained evidence for tamper-evident run history
  • Runtime recovery with isolation, checkpointing, reassignment, and replay verification
  • Provenance-gated memory architecture
  • A versioned first-party agent registry
  • Firestore integration for persistent evidence/memory architecture
  • A production-oriented web interface designed to make the entire security lifecycle visible to an evaluator

Instead of making every security decision probabilistic, we deliberately separated reasoning from enforcement. Gemini can analyze and explain complex failures, while deterministic controls enforce security invariants.

This gives TRUSTFORGE ZERO both intelligent reasoning and reproducible security behavior.

Challenges we ran into

One of the hardest problems was designing an agent security system that remained trustworthy when its AI provider was unavailable or rate-limited.

Rather than bypassing the problem, we made provider evidence part of the certification invariant.

If live AI attestation cannot be obtained, deterministic controls can continue executing, but final certification fails closed.

We also had to balance multi-agent intelligence with latency and API quotas. The resulting architecture uses Gemini where reasoning provides the greatest value while deterministic specialists handle reproducible controls.

Another challenge was making runtime recovery itself auditable. A recovered workflow is not automatically trusted: isolation, checkpoint recovery, resumption, and replay must all be evidenced before certification can proceed.

Accomplishments that we're proud of

We built a working end-to-end autonomous security loop rather than a static security dashboard.

A single gauntlet can:

attack → identify failures → diagnose root causes → harden controls → replay attacks → verify provenance → issue or deny a Trust Passport

The system currently executes a 10-vector security gauntlet and produces a hash-chained evidence stream for the complete lifecycle.

We are particularly proud of the fail-closed certification architecture: TRUSTFORGE ZERO refuses to convert missing evidence into a successful security claim.

We also built explicit human-governance boundaries for high-risk actions so that autonomous execution cannot silently cross designated authorization thresholds.

What we learned

Building trustworthy agents requires more than adding another AI model.

The strongest architecture came from combining:

AI reasoning + deterministic enforcement + identity boundaries + provenance + recovery + continuous evidence.

We also learned that observability should not merely describe what an agent did after the fact. Evidence should directly determine whether that agent is allowed to act.

That idea became the foundation of the Trust Passport.

What's next for TRUSTFORGE ZERO

The next step is evolving TRUSTFORGE ZERO from certification runs into a continuous enterprise immune layer for autonomous agent fleets.

Future work includes deeper runtime identity integration, expanded MCP/tool supply-chain verification, persistent regression intelligence, continuous re-certification when agents or permissions change, richer attack-graph visualization, and broader enterprise policy integration.

The long-term vision is simple:

Every autonomous agent should have to continuously prove that it deserves the authority it has.

Built With

Share this project:

Updates

Submission history