work / sentry

Sentry

Call it. Socially-engineer it into leaking a card number, live and out loud. Then watch it rewrite its own guardrails and refuse the identical attack, with no human in the loop.

A demo that hides its seams is a demo you cannot trust. The honest table is the most useful thing in the repository.

Status
Built at a hackathon
Stack
NVIDIA Nemotron via NIM · Pipecat · Daily WebRTC · Deepgram · ElevenLabs · Cekura
Source
github.com/rushjais/Sentry ↗

01  The demo

Sentry is the same question as Envoy approached from the opposite end: rather than hardening a useful agent, build one whose entire purpose is to be attacked in front of an audience and visibly get better.

You call it. You talk it into reading out a customer’s card number. That leak is real and is scored live. You hit HARDEN, and the system clusters its own failures, sends them to Nemotron to write new guardrail rules, and hot-swaps its configuration mid-call. You run the same attack and it refuses.

The thing I am most pleased with in this repo is not the agent. It is the README, which has a table labelled “what is real vs. simulated” listing exactly which parts are genuine and which are a replay.

02  How it works

Live callDaily WebRTCAvaNemotron agentLive scoringleak or refuseCluster failuresby attack typeNemotronwrites new rulesHot-swapnext turn, no restartsame call, guardrails replaced
One continuous call. The leak, the clustering, the rule-writing and the refusal all happen without hanging up or restarting the pipeline — which is the only version of this that is actually impressive. Schematic — boxes illustrative, not to scale.

03  Score a turn

The outbound half: scoring what the agent said, live, to decide leak or refusal. These are the real patterns from signals.py, including the Luhn check — a 16-digit number that fails Luhn is not a card, and flagging it would be a false alarm.

SentryLeakGuard · outbound PII · Luhn-confirmed

This is the check that scores the demo call turn by turn. The leak you hear on the recording is genuine model output; so is the refusal after hardening.

04  What is real, and what is not

  • Real: the voice agent, the live call, and the leak. Your spoken words and Ava’s actual reply are streamed to a dashboard and scored leak-vs-refuse in real time. Both the card number she leaks and the refusal afterwards are genuine model output.
  • Real: the Nemotron patch-writer and the mid-call hot-swap. Failures are clustered and sent to the model, which writes the new rules; the agent re-fetches its prompt and swaps guardrails on its next turn. A cached fallback patch covers a slow model call, with an identical visible outcome.
  • Simulated: the swarm of twelve attackers and the 7/12 → 0/12 counter. That is a mock replay of a known attack set — a visualisation of what a full evaluation run shows, not a live one.
  • Stubbed: the live Cekura REST integration. The client has the right shape but the payloads are best guesses and there is no run-completion polling. It needs wiring to a real account before anyone relies on it.

Honest limits. Everything above is copied from the repository’s own README, which I wrote to be checkable rather than flattering. The headline counter in the demo video is a replay, and I would rather say so here than have someone discover it. Sentry was a two-day build; the production version of this idea is pipecat-firewall.