# testigo+

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Joen Anaya Ortega](https://cerebralvalley.ai/u/Joen_anaya), [Nicolay Camargo Riascos](https://cerebralvalley.ai/u/docNicolay)
- **GitHub:** https://github.com/joen-ao/testigo
- **Demo video:** https://www.youtube.com/watch?v=AB9hyku9Z9c
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3586

TESTIGO+ is an independent witness for computer-use AI agents, built on Meta's models. Agents like Muse Wonder can now open pages, fill forms and confirm orders on their own. That creates a new attack surface: the web page itself can lie to the agent. It can hide an instruction in its code, paint it faintly into an image, forge the delivery address on screen, or swap the address a few seconds before the agent clicks Confirm (a time-of-check to time-of-use attack). Today we trust two things an attacker controls: what the agent says it will do, and the page's own code.

TESTIGO+ trusts neither. It sits between the agent and the browser and looks at the screen the way a person would. For every sensitive click it checks three things:
1. Policy: the action fits the owner's signed rules (ship only to the company warehouse, at most USD 1,500 per order). The owner dictates the rules by voice, and Muse Spark compiles them into a signed policy.
2. Approval: the person approved exactly this order, looking at real crops of the screen and reading the total and destination aloud (checked with Voice Transcribe).
3. Execution: after the click, TESTIGO+ captures the screen again and confirms that what executed is what was approved.

How it reads the screen: SAM 3.1 boxes the order total, the "Ship to" address and the buttons; Muse Spark reads those crops only as fixed-format extraction, never as instructions; the visible text and the page code are compared both ways; and plain rules in code, not a model, make the final decision. So the verifier cannot be talked into anything. If anything differs, the click is blocked. Every approved order leaves an Ed25519-signed receipt with the hashes of the evidence crops, which anyone can check offline with "testigo verify".

Results with Meta's real models (WitnessBench, Nov 1, 2026, 52 configurations): without TESTIGO+, 5 of 20 attack orders reached the attacker's address (forged address: 3 of 5; address swapped at Confirm: 2 of 5). Muse Wonder ignored every written prompt injection, but it fell when the screen itself lied. With TESTIGO+, 0 of 20 reached the attacker, and 0 of 5 clean orders were blocked (false positives). Median added time: 13.8 s per check. We report counts, not percentages, and publish the known limit of our instruction filter.

What we did not find published elsewhere: a pixel check after the click, a two-way code-versus-screen comparison inside the agent loop, and receipts that carry the hashes of the evidence.

It is open source (Python, FastAPI, Playwright), runs as an MCP server so any computer-use agent can call it before confirming, and includes a guided live demo. The supplier portal, the order and the addresses are simulated; the agent, the detection, the approval, the signatures and the measurements are real.

## More from Meta Global AI Developer Hackathon

- [SIAGA.ID](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3583)
- [Mihail Cernei](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3584)
- [kanyaraasi](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3585)
- [Senda](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3587)
- [Only me](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3588)
- [Gonduras Meat Market (GMM)](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3589)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3586. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt