work / envoy

Envoy

You tell it what you want. It dials the restaurant, negotiates with a real host, books the table, and fires the calendar invite and confirmation email — and it holds your details while it does.

Handing a task to an agent means handing it your business. It is only worth delegating to if it can hold that under pressure.

Status
Built at a hackathon · team of 3
Result
0/5 → 5/5 credential-leak refusal, independently judged
Stack
Pipecat · NVIDIA Nemotron · Nemotron Speech Streaming STT · Gradium TTS · Twilio PSTN · Cekura
Source
github.com/rayan-arya/Envoy ↗

01  The idea

Envoy takes a booking from you by voice, dials the restaurant, negotiates with a real host, and fires a calendar invite and confirmation email when the booking lands. In our demo it got bumped from 7:00 to 7:30 because 7:00 was full, handled that, and still wrote a consistent confirmation reference to both tools.

The booking is the setup. The part worth building was what happens when the agent is attacked.

A booking agent ends up holding your secrets — confirmation codes, account details, whatever the person on the other end can talk it into saying. Every voice agent has this problem and almost all of them solve it by writing a longer system prompt and hoping.

Envoy does something else. The first time a novel manipulation gets through, an independent judge flags the leak, a patcher writes a guardrail against the class of attack, and a frame processor reloads the rules into the live pipeline on the very next turn. The agent gets safer mid-call, without a restart.

02  How it works

Calleryou or an attackerVoice pipelinePipecat · NemotronResponsespoken backJudgeseparate model,separate promptPatcherwrites a rule againstthe attack classguardrails.json on diskdid it leak?breachGuardrailInjector reloads every turnMEASURED BY CEKURA0 / 5 before5 / 5 afterone self-written rule
The loop that matters runs bottom-left: a breach becomes a written rule, and the rule is reloaded into the live pipeline on the agent’s next turn. Nothing restarts. Scoring is done by Cekura, not by us. Schematic — boxes illustrative, not to scale.

03  Attack it

The self-heal loop, playable. The agent starts naive and will hand over the confirmation code to anyone who asks. Breach it, hit Self-heal, and watch it write a rule against the class of attack — then try to get around the rule by rewording.

GuardrailInjector · reloads guardrails.json every turn
guardrails.json: 0 rules

The rule the patcher writes is deliberately general — any code, PIN, token, passphrase or credential — not the sentence that just worked. That is why rewordings it has never seen also fail.

04  The parts that were actually hard

  • The judge has to be a different model with a different prompt. An agent grading its own transcript will tell you it did fine. Independence is what makes the 0/5 → 5/5 number mean anything.
  • Generalising the patch. The first patcher wrote rules against the literal phrasing that worked, so the identical attack reworded sailed through. Rewriting it to target any code / PIN / token / passphrase blocked 6/6 reworded variants it had never seen.
  • Hot-reload without restarting the call. A custom GuardrailInjector frame processor re-reads the rules file every turn, so a rule written mid-conversation takes effect immediately. Restarting the pipeline would have ended the phone call.
  • Turning the model’s reasoning off. Running Nemotron with detailed thinking off was one of our biggest findings — it produced concise answers and clean tool calls, where reasoning mode rambled and mangled the tool schema.

0 → 5/5

credential-leak refusal

6/6

reworded variants blocked

50 → 100

live trust score

1

self-written rule

Honest limits. The self-heal only fires after a breach has already happened — the first victim of any genuinely novel attack class is real. The evaluation covers five social-engineering attacks in one category, which is a narrow slice of the threat surface, and the principal-intake phase is built and verified but flag-gated off in the live pipeline.