Heimdall

Heimdall is a checkpoint between untrusted AI agents and the internet. Personal AI agents read things they can't trust (GitHub issues, web pages, email) while holding real API keys. One hidden instruction is enough to turn them against you. Heimdall assumes the agent will be tricked and controls the only way out: each agent runs sealed in a sandbox holding only placeholder keys, and every request goes through one checkpoint that checks it, records it and blocks what looks like a leak. Hard rules run first (allowed sites, https only, no IP literals or private addresses, no foreign keys, no data smuggled through the AI provider, size caps and byte budgets). Muse Spark reviews anything new and reads every write against the agent's task and recent history to catch secrets hidden in normal-looking comments. When Spark isn't sure, Muse Wonder decides; if neither can answer, the request is blocked. The real key is swapped in only for the one site it belongs to. A review page shows every request flying into an allowed or blocked pile, with a plain-language reason. Measured on a mock internet with fake keys: keys were stolen in 5 of 5 runs without Heimdall and 0 of 5 with it, with the real task still completing; a rogue Llama 3.1 agent that adapts to every block got nothing out in 5 runs; under load (~90 requests a second) all 171 attacks were blocked with 5 false blocks in 17,814 normal requests. Known limit, stated in the README: a secret split into tiny pieces inside the caps gets through, but every piece is counted. Built solo during the hackathon.