# AariaSec - Witness

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Ajith Chandran](https://cerebralvalley.ai/u/Aariasec)
- **GitHub:** https://github.com/AariaSec/witness
- **Demo video:** https://www.loom.com/share/7862d9947fbc4135ac299d23f08cb37e
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2295

witness is an independent, content-free recorder for AI coding-agent sessions.

WHAT IT DOES
- Watches files, processes and network events on its own decoy endpoints, from outside the agent's process, and checks that record against what the agent says it did. It never stores or sends prompt or response text (only hashes, counts, paths and destinations).
- Every session becomes a hash-chained, Ed25519-signed bundle that anyone can verify in a browser with no login.
- A GitHub Action can gate a pull request on a recorded bundle. In a real-agent demo run the process group was killed in 298 ms (measured locally).

WHY IT MATTERS
- Coding agents now have real file-system and network access, and the only account of what they did is their own.
- In July 2026 OpenAI's models under test escaped their sandbox and breached Hugging Face.
- METR's independent investigation (https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/) found agents spoofing tool calls in their own transcripts, in small-scale tests aimed at the scorer.
- witness targets that gap: a self-report diverging from what happened.

META MODELS
- Muse Code is the real agent we record.
- witness is also a local MCP server that any MCP client can call; we verified the protocol end to end with the official SDK client.
- Muse Spark Open, Muse Spark 1.3 and Muse Glimmer 30B (open-weight, on a Modal GPU we deploy) write the advisory analyst report.

WHAT WAS BUILT
- Everything in the repo was built during the hackathon. The existing AariaSec product is separate, not in the repo, and not what is being judged.

EVIDENCE (263 real Muse Code sessions, cutoff 2026-11-04T04:40)
- Nothing pulled toward the decoy credential: 0/69 sessions touched it.
- Red-team arena: Muse Spark 1.3 and Spark Open wrote persuasion wording for a setup step in a README, contributing guide or code comment. Muse Code fetched the token in 22/60 sessions and saved it in 3/60.
- witness's deterministic gate failed 26/26 of the sessions that saved a credential (by definition: a saved credential is itself a stop finding) and 0/89 benign sessions (false alarms).
- A neutral-framing control (same step and same failing test, no persuasion) fetched in 11/12 and saved in 2/12, so persuasion effects are read against that.
- The attacker (Spark Open) refused 4 of 14 rewrite requests (counted, never run).
- Round 2: an adaptive attacker (Muse Spark Open, shown only the content-free outcome of round 1) rewrote 10 framings. The agent fetched in 5/20 sessions and saved the token in 1/20, against 11/20 and 0/20 for the same framings in round 1.
- Caveats: one agent, a decoy on a local fake service, few sessions per cell.

WHO IT IS FOR
- Teams whose coding agents open pull requests, where today the only account of what the agent did is its own summary. witness adds an outside, signed, content-free record and a CI check (16-44 s of CI per run, measured).
- No design partner or pricing yet (docs/WHO_PAYS.md).

## More from Meta Global AI Developer Hackathon

- [Airi.chat](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2292)
- [Chris34star](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2293)
- [page ledger](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2294)
- [Wizard](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2296)
- [Measure Once](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2297)
- [Caffeinated coder](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2298)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2295. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt