# Team Invincibles

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Matheshwaran Prakash](https://cerebralvalley.ai/u/matheshprakash)
- **GitHub:** https://github.com/mathesh310703/agentgate
- **Demo video:** https://youtu.be/iL84Xk8tc5E
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1177

AgentGate is a deterministic gate for AI agents that use tools such as email, files and calendar. Agents can obey instructions hidden in what they read: emails, files, even faint text inside a screenshot. AgentGate labels every piece of text by where it came from (the user's request, tool text, or text recovered from an image). Before any risky call, it checks that every checked argument (address, file, amount) traces back to the user. If one does not, the call is blocked with a plain-language reason. It is a rule, not a model, so no model has to resist the attack.

Results (AgentDojo v1.2.2 workspace suite). With a scripted worst-case agent that obeys every injection, successful attacks go from 231 of 240 to 0 of 240, and 0 of 120 on a held-out half with no legitimate call blocked. A small real model that does get fooled by hidden-line screenshots (Qwen3-VL-2B) leaked 20 times in 390 episodes without the gate and 0 of 390 with it. Muse Spark Open resisted every attack on its own (0 of 165), so the gate is for models that do not.

Meta models: Muse Spark Open is the agent under test, the optional isolated judge and optional image reader, and the red-team attacker. As attacker it got through the default gate 30 of 90 times, always via one known gap (a trusted sender or owner field). An optional rule written afterwards bypassed 0 of 90 on a fresh run, at no measured cost on the held-out tasks. Llama Prompt Guard 2 is measured as a baseline.

Limits are in the README: five known trust gaps by default, a scripted attacker, and small, clustered samples. MIT licence. Built with Claude as a coding assistant; the design and experiments are mine. Test data only.

## More from Meta Global AI Developer Hackathon

- [I-am-Solo](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1174)
- [WendstormXR](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1175)
- [Groundwork](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1176)
- [Surgical](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1178)
- [NAZAR](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1179)
- [ExplainBack](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1180)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1177. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt