OVARA Arena

An AI agent keeps the books for a small design studio and works its PayPal sandbox account through PayPal's own MCP server. It reads client emails, images included. A second model writes attack emails that hide an instruction in the pixels of an attachment: a faint footer, tiny print, near-white text, a stamp, or a handwritten sticky note. OVARA, our open-source gateway, sits on the wire between the agent and PayPal and holds every call that moves or forgives money until a person says yes. Meta's Muse Spark plays every role: it writes the attacks, it keeps the books (vision plus tool calling), and after an incident it drafts the policy rule that OVARA validates before one click applies it. The same eight attacks were sent with OVARA off and with OVARA on, live on the PayPal sandbox. Off: four invoices cancelled, USD 4,800 of receivables gone. On: nothing reached PayPal; the two calls that got past the model stopped at the gate. Every round, trace, image and receipt is in the repository as recorded data, and the console replays them with the hidden instruction boxed. Limits are reported too: eight attacks, one pass per mode, a non-deterministic agent, and rules that match tool names rather than arguments.