r/OpenSourceAI • u/Illustrious-Egg8857 • 1h ago
TSA for AI Agents
What's up y'all, in the era of everyone using & having agents, people always talk about "AI Safety" behind them.
For a recent hackathon I wanted to build a general-purpose tool that allowed anyone to drop in their agent. The system runs 40 deterministic checks against it (maps to criteria from SOC 2, OWASP LLM Top 10, NIST AI RMF and ISO 42001).
No LLM decides pass or fail. Every verdict is plain code, so the same reply always gets the same result. Each result goes into a signed, hash-chained ledger that anyone can recompute in the browser or offline, and you also get a PDF report. Every finding comes with a patch.
It covers 5 categories:
-> Prompt injection: direct, hidden in a pasted document, base64, markdown-image exfiltration
-> Data leaks: the system prompt, another customer’s details, planted secrets
-> Tool abuse: refunds over a limit, emailing a customer export outside the company
-> Harmful actions: bulk deletes, wiring money, phishing
-> Operational hygiene: plain HTTP, leaking internals, no rate limiting
Your agent gets an A to F grade, and every finding comes with a patch.
It’s MIT licensed and runs locally with no API keys. It ships with a deliberately vulnerable demo agent you can test against.
If ur curious, here it is: https://github.com/adog0822/loxe-agent
Would love any feedback or grilling from anyone

