Warden

Companies now let teams of AI agents pay their invoices: one reads the invoice, one matches the purchase order, one approves, one pays. This opens the door to Business Email Compromise, the fake invoice scam that cost businesses 2.77 billion dollars in 2024 (FBI IC3). An attacker sends an invoice that looks normal but has the bank account swapped to their own, and the agents pay the thief. Warden is a security crew that watches the other agents. When a tampered invoice enters, Warden does not trust the document. It re-derives the real payee and amount from the company's own records and compares them. If they do not match, it raises a warning. The Investigator then recruits a Threat-Intel specialist live into the Band room, which screens the account against a fraud watchlist. The Enforcer removes the compromised agent and freezes the payment before any money moves. The key idea: a committee of LLM agents can all be fooled by the same poisoned document. Warden cannot, because its security decision is deterministic, plain code with no LLM in the gate. It checks what a correct payment looks like, so brand new attacks are caught without new code. How we used Band: the Investigator calls add_participant to pull in the specialist (agents recruiting agents), the Enforcer calls remove_participant to eject the hijacked agent, and join and leave events act as a tripwire. Proof: an attack battery blocks 6 of 6 real attacks (payloads from AgentDojo and InjecAgent), 54 tests cover the core, every decision is written to a signed and tamper-evident audit log, and it runs live on Band. AI/ML API (gpt-4o-mini) reads the invoice, and Featherless running the Qwen 2.5 model writes the risk note.