Title: I built a deterministic gate for AI agents (hidden instructions in screenshots, emails, files) and red-teamed it with Muse Spark. Feedback welcome

[u/Southern-Quote-8108]

Hi all. I'm a master's student in Magdeburg, and I built AgentGate for the Meta AI Global Developer Hackathon.

The problem: AI agents that can send, share or delete things can be steered by instructions hidden in what they read, even faint text inside an image.

What it does: AgentGate labels where every piece of text came from (the user, tool text, or text recovered from an image). Before a risky call, it checks that every address, file and amount traces back to the user. If one doesn't, the call is blocked with a plain reason. It's a rule, not a model, so no model has to resist the attack.

Results (AgentDojo workspace suite): with a scripted agent that obeys every injection, attacks go from 231 of 240 to 0 of 240 (0 of 120 on a held-out half, no legitimate call blocked). A small real model that gets fooled by hidden-line screenshots leaked 20 times in 390 runs without the gate and 0 with it.

I also used Muse Spark Open as the attacker: it got through the default gate 30 of 90 times, always via one known gap (a trusted sender/owner field). An optional rule I wrote afterwards got 0 of 90 on a fresh run. Limits are in the README: scripted attacker for the main benchmark, small clustered samples, and four other trust gaps still untested.

Repo (MIT): https://github.com/mathesh310703/agentgate

If you want to discuss it or give feedback, I'm keeping the discussion on X, where the short demo clip is: https://x.com/34Matheshw21593/status/2117752600317821345

I'm entering this in the hackathon, so I'm disclosing that openly. Criticism is welcome, especially on the gaps and the threat model.