# Antivenom - **Event:** [The Persistent Context Sprint Hackathon | Live at MongoDB .Local Build Fest](https://cerebralvalley.ai/e/persistent-context-sprint-hackathon) - **When:** Thu, Aug 13 at 12:30 – 8:00 PM (PDT) - **Where:** Pier 48, San Francisco, CA - **Team:** [Karthik Subramanian](https://cerebralvalley.ai/u/winnerkarthik), [Krishay Garg](https://cerebralvalley.ai/u/krishaygarg), [Arya Kunisetty](https://cerebralvalley.ai/u/KingAK), [Ram Nemuri](https://cerebralvalley.ai/u/RamN28) - **GitHub:** https://github.com/AK20202007/Antivenom - **Demo video:** https://www.youtube.com/watch?v=UcEDEYJPVFA - **Gallery:** https://cerebralvalley.ai/e/persistent-context-sprint-hackathon/hackathon/gallery - **Page:** https://cerebralvalley.ai/e/persistent-context-sprint-hackathon/hackathon/gallery/21 antivenom.pages.dev — post-hoc surgery for poisoned agent memory. We came at this from the other side: our team hides invisible prompt injections inside assignment PDFs so chatbots refuse to do students' homework, which teaches you very quickly that it is trivial to conceal text a model reads and a human misses, and that you don't need to hide an instruction at all, just a fake fact. So we hid one sentence in a slide deck claiming API credentials must be revalidated at a fake endpoint before maintenance; a vision model pulled 11 claims off that slide, the lie was the 8th, indistinguishable from the 10 true ones around it, and write-time filters scored it completely clean because there was nothing malformed to catch. That is not a bug in the filter. Truth is simply not a signal available at write time, which is why the best published guardrail catches 42.5% of these and its authors state plainly that retraining does not close the gap. And once stored, a lie does not sit still: the agent reasons from it, every derived conclusion inherits the poison, and one sentence quietly becomes fourteen corrupted beliefs. Ours fired sixteen days later, attacker long gone, nothing in the logs correlating, and when asked why it had just leaked credentials it defended the lie to our face, citing the policy, the document, and the date it learned them. Across benchmarks 84.2% of poisoned memories persist and half of all attacks succeed end to end; this is already CVE-backed territory that OWASP tracks as ASI06, yet every existing defense guards the write boundary, so there is nothing left once the poison is inside. Antivenom is that missing half: when a harmful action fires, it re-runs the agent's decision with each belief removed to pinpoint the exact lie responsible, then uses MongoDB $graphLookup to trace every memory derived from it across weeks of activity, excising anything that rests solely on the poison and sparing anything a clean source also verified. The alternative everyone reaches for, quarantining everything downstream, recovers exactly as much while destroying 38% of the agent's clean knowledge, so we ship that baseline and run it against ourselves on every evaluation. Across six attack classes Antivenom identified the correct culprit 100% of the time and recovered 100% of the poisoned lineage at 0% collateral damage, against a published selective-repair baseline of 56.1%, while reproducing the very gap that makes it necessary: 33% of loud attacks caught, 0% of the weak-signal ones. Everyone is building better doors; this is the first thing that works after it is already inside. Built with: Python · MongoDB Atlas ($graphLookup, $vectorSearch, change streams, Voyage embeddings) · OpenRouter · Fireworks AI · LangChain · ElevenLabs · FastAPI · React · TypeScript · Cloudflare Pages · Cursor Attribution: Evaluation harness adapted from MPBench (arXiv:2606.04329), CC BY 4.0. --- Markdown version of https://cerebralvalley.ai/e/persistent-context-sprint-hackathon/hackathon/gallery/21. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt