Parallax.

THE PROBLEM

AI agents can read documents, call tools, search repositories and take actions on behalf of users. Untrusted emails, pages, retrieved files or tool responses may contain instructions intended to redirect an agent, disclose secrets or misuse a permitted tool. Traditional filtering of user prompts does not establish trustworthy boundaries for tool permissions.

YOUR CHALLENGE

Build a defensive security layer that monitors and constrains an AI agent or tool-driven assistant operating in a simulated environment. It must distinguish legitimate tasks from unauthorized instructions arriving through untrusted content, prevent at least one category of unsafe tool action, and provide an inspectable reason for its decision.

BUILD IN 24 HOURS

• Minimum working demo: one simulated agent, at least two tools or permissions, a policy enforcement point, and an audit log.
• Security scenarios: a legitimate task, prompt-injected web or document content, an unauthorized sensitive-data request, and a tool invocation beyond permission. Use synthetic data only.
• Show explicit allow, deny, or require-approval decisions; user confirmation for high-impact actions; and fail-closed behavior when confidence or policy is insufficient.
• Optional extensions: MCP gateway, tool permission profiles, signed tool metadata, cross-agent audit trails, or a risk-aware approval queue.

THE PROBLEM

Vulnerability scanners often produce noisy alerts, while remediation tools propose code changes that can break legitimate functionality. Smaller teams need evidence that a finding is real and that a patch removes the weakness without introducing regressions.

YOUR CHALLENGE

Build a tool or workflow that identifies security weaknesses in deliberately vulnerable sample software, proposes or applies a defensive fix, and validates that the fix stops the original exploit condition while preserving expected application behavior. AI assistance is optional; accuracy and verification matter more than model complexity.

BUILD IN 24 HOURS

• Select a supplied or public deliberately vulnerable practice app or local fixture, and document the precise in-scope files.
• Identify at least two defensible weakness cases, such as unsafe input handling or broken access control, with evidence grounded in source or executable tests.
• Provide a minimal patch or actionable diff for at least one verified issue, then run a regression and security test.
• Display the severity rationale, exact affected code location, patch rationale and test status.

THE PROBLEM

Phishing increasingly combines convincing wording, impersonation, shortened or confusing links, and multi-channel messages. Static keyword filters can misclassify legitimate messages and do not explain what evidence led to a warning. Indian users and small organizations also face multilingual and code-mixed messages.

YOUR CHALLENGE

Build a privacy-conscious defensive assistant that assesses suspicious messages or simulated identity claims, explains the risk signals, and recommends safe verification steps. Support at least two realistic message types or languages. Detect risk without automatically opening links, sending replies or taking actions on a user's behalf.

BUILD IN 24 HOURS

• Analyze a curated synthetic dataset containing benign and suspicious examples across any two channels or languages, such as email and SMS or English and Kannada/Hindi.
• Extract defensible signals: sender or domain inconsistency, URL obfuscation, suspicious urgency, requests for credentials or financial action, and missing provenance.
• Present a risk tier, cited textual evidence and clear verify-through-a-known-channel guidance; allow users to challenge a false positive.
• Optional extension: synthetic voice or deepfake flagging, suspicious QR content, or a reporting dashboard. Deepfake detection is optional, not mandatory.