# Agent Harness Hackathon 2026 — What I built, how I used TrueForge, and what I learned > Source: > Published: 2026-08-30 09:08:14+00:00 THE PROBLEM Ransomware attacks cost organizations over $20 billion every year. Security teams are drowning in 11,000+ alerts per day, most of which are false positives. By the time a human analyst investigates, the encryption has already spread to hundreds of files. The average response time? Hours. The average recovery cost? $2.73 million. I wanted to build something that could change that — an AI agent that doesn't just detect threats, but investigates and responds to them autonomously, while still keeping a human in the loop for irreversible actions. That's how AutoVault was born. WHAT I BUILT AutoVault is an autonomous AI security operations agent that runs on TrueForge, the open-source agent harness by TrueFoundry. It detects ransomware in 0.3 seconds, spawns 5 parallel subagents to investigate, and responds autonomously — but always stops to ask a human before doing anything irreversible. HOW I USED TRUEFORGE TrueForge isn't just a dependency — it's the brain of the entire system. I used every single TrueForge feature, all 12 of them. MCP TOOLS I built 4 Python MCP servers using the MCP SDK v2: Each tool has full input schemas, proper error handling, and returns structured JSON. SUBAGENTS TrueForge's subagent system was a game-changer. I spawned 5 specialized agents that run in parallel: The speed improvement was dramatic — what took hours now takes seconds. SANDBOX (DAYTONA) I wrote 20 Python scripts that run safely in TrueForge's Daytona sandbox: HUMAN APPROVALS TrueForge's approval system lets me define 10 rules with risk scoring: The 7-step workflow ensures nothing irreversible happens without a human saying yes. SKILLS I created 4 instruction packs that TrueForge loads dynamically: CONTEXT ENGINEERING TrueForge's context engineering kept the agent efficient: PERSISTENT SESSIONS The agent saves its state to SQLite every 30 seconds. If the connection drops mid-investigation, it resumes exactly where it left off. THE 13 INNOVATIONS Human-Like Memory Architecture — Episodic, semantic, procedural, and working memory. The agent remembers past attacks. Predictive Ransomware Defense — Predicts attacks 30 minutes before they happen. Recursive Self-Improvement — The agent improves its own code and algorithms. Collective Intelligence Swarm — Hive mind of agents making decisions together. Neuromorphic Processing — Brain-inspired neural networks with sub-millisecond latency. Self-Healing File System — Automatically restores encrypted files from blockchain backups. AI Red Team vs Blue Team — Two AI teams compete and improve through adversarial training. Knowledge Graph — Graph database mapping relationships between threats, actors, tools, techniques. Federated Learning — Multiple organizations train models without sharing sensitive data. Digital Twin Simulation — Virtual replica for risk-free security testing. Adversarial Robustness — Defends against attacks designed to trick the AI. Natural Language Threat Intelligence — Query threats using plain English. Self-Learning Security Evolution — Detection models evolve using genetic algorithms. THE QODO CODE REVIEW EXPERIENCE Every change goes through Qodo review via GitHub Actions. On PR #1, Qodo found: All three were real issues. I fixed all HIGH findings and documented everything in the README. WHAT I LEARNED TrueForge Is More Than a Wrapper — The MCP tool system, subagent orchestration, approval workflows, and context engineering are all deep, production-grade features. Parallel Subagents Change Everything — Running 5 investigations simultaneously isn't just faster — it's qualitatively different. Human Approval Is Non-Negotiable — For a security tool, having human approval is critical. TrueForge made this trivial to implement. Qodo Actually Finds Bugs — It understands context and finds issues that surface-level analysis misses. The Sandbox Is Your Safety Net — When running scripts that analyze potentially malicious files, you need a sandbox. Documentation Matters — Writing the README forced me to think about what I actually built and why. TRY IT YOURSELF github.com/ItsParthPinjarkar/autovault git clone [https://github.com/ItsParthPinjarkar/autovault.git](https://github.com/ItsParthPinjarkar/autovault.git) cd autovault pip install -r agent/requirements.txt pip install -r mcp-server/requirements.txt bash setup-trueforge.sh python demo_advanced.py ACKNOWLEDGMENTS Built for the Agent Harness Hackathon (August 24-30, 2026). This project was built with AI assistance. All code has been reviewed, tested, and understood by the developer.