I built a public, cryptographically signed test registry for AI agents (student project)

a998 — Fri, 25 Sep 2026 07:08:03 +0000

Hi everyone! 👋

I’m a final-year BTech CSE student.

The Problem I Noticed
As AI agents start doing real tasks (like sending emails or accessing files), we currently just have to trust the developer's word that the agent is safe from being tricked or hijacked. There is no simple, public way to verify an agent's actual safety record.

My Attempt at a Solution: A2A-G
I built a small, open-source project called A2A-G to explore if we could make agent safety public and testable.

Here is in short how it works:

Grey Badge: An unverified self-report of what the agent claims to access. (To be clear: this is just a claim, not verified by us).
The Choice: After the Grey Badge is issued, the owner is simply asked if they want to earn a Blue Badge. Testing is completely optional.
Mock Sandbox: If they choose to test, they must provide a safe, consented mock sandbox environment. We never test live production systems.
The Test: We send 18 OWASP hijacking prompts, 3x each, randomized. An LLM judges if it blocked or complied.
Blue Badge: 80%+ blocks earns a Blue Badge. Failures are published openly too.
The Proof: Every result is cryptographically signed (Ed25519) and hash-chained, so the history cannot be faked or hidden.

Honest Limitations
I want to be completely transparent: this is an early, solo-built attempt. The testing methods aren't perfect yet, and it doesn't solve all AI security problems. I simply built it to learn if public, verifiable safety records are practical.

I’d Love Your Feedback

I would deeply appreciate any honest technical feedback, opinions, or critique on the mock sandbox approach.

🔗 Live Site: https://a2ag-website.vercel.app/
💻 GitHub: https://github.com/Annora998/a2ag-website

Thank you for reading!

DEV Community: a998

I built a public, cryptographically signed test registry for AI agents (student project)