# Al-Munaa for OpenAI Build Week > Source: > Published: 2026-07-18 21:06:38+00:00 ## Inspiration AI agents can read files, call tools, and act across systems. That power creates a new failure mode: an indirect prompt injection hidden in a document can convince an otherwise useful agent to read secrets and send them to an attacker. Traditional prompt filters are local and brittle. AL-MUNAA asks a different question: what if agents could develop an immune memory and warn other trusted agents without sharing the original private prompt or secret? ## What it does AL-MUNAA is a developer tool for agent safety. It wraps agent workflows with input and memory scanning, an action gate, output verification, and a Threat Antibody Protocol. When one agent detects an attack, it creates a signed, privacy-safe HMAC fingerprint. Another agent in the same trust family can verify that antibody and block a mutated version of the attack before any dangerous tool call executes. In the demo, the same malicious runbook succeeds without protection: the unprotected agent reaches a read tool and a sink tool. With AL-MUNAA enabled, the action gate blocks the dangerous call before execution. A second agent then receives a signed antibody and blocks a modified attack without seeing the original secret-bearing prompt. ## How we built it The core is a Python package with deterministic guardrails and reproducible tests. The antibody matcher combines Jaccard similarity with padding-resistant containment matching, uses bounded HMAC sketches, and rejects antibodies imported from a different trust family. The repository includes a CLI demo, calibration script, CI matrix, and an installable GitHub release so judges can test it without rebuilding from scratch. ## How Codex and GPT-5.6 were used Codex on GPT-5.6-Sol performed test-first work on the core protocol. It reproduced a near-threshold weakness, added containment matching, expanded the bounded HMAC sketch from 256 to 512 entries, enforced trust-family rejection, created a calibration matrix, repaired the installed-package entrypoint, and documented the evidence. GPT-5.6 is also used inside the product through the OpenAI Responses API as a structured intent analyst for gray cases and as a bounded defensive vaccine generator. Deterministic policy remains the final authority; GPT-5.6 advises on uncertain cases and produces defensive variants that are stored only as hashes. Codex /feedback Session ID: 019f72df-5fa7-7cf1-95f4-265467d02099 ## Evidence - Full local suite: 74 tests passed. - Legacy matcher: 3/4 attacks detected, 0/5 false positives. - Calibrated matcher: 4/4 attacks detected, 0/5 false positives. - Demo margin improved from 0.0264 to 0.1474. - 64 deterministic family keys produced 576 fixture evaluations with zero fixture errors. - Live GPT-5.6 Sol action-gate benchmark: unprotected read=1/sink=1; protected guard_blocks=1/read=0/sink=0. - Live in-product GPT-5.6 paths: gray-case verdict block at confidence 0.99, plus two defensive vaccine variants stored only as hashes. ## Challenges and limitations The hard part was keeping the evidence honest. The calibration matrix is intentionally small and synthetic, so AL-MUNAA does not claim production-wide recall, zero false positives, or protection from every semantic rewrite. The current version is a focused vertical slice: strong enough to demonstrate the idea, narrow enough to be testable by judges. ## What's next Next steps are larger real-world attack corpora, framework adapters for popular agent runtimes, team-scoped trust-family management, and a dashboard for viewing antibody propagation across agent fleets. Repository: [https://github.com/Farhanward/al-munaa](https://github.com/Farhanward/al-munaa) Release: [https://github.com/Farhanward/al-munaa/releases/tag/v0.1.1](https://github.com/Farhanward/al-munaa/releases/tag/v0.1.1) Portfolio: [https://portfolio.carbonflows.store/?v=farhan-almutairi&lang=ar](https://portfolio.carbonflows.store/?v=farhan-almutairi&lang=ar) ## Built With - ai-agents - codex - cybersecurity - developer-tools - gpt-5-6 - hmac - openai-api - prompt-injection - pytest [python](https://devpost.com/software/built-with/python)