DEV Community: Ashraf

The internet's advice on UK student visa funds is quietly out of date. I built something that checks the actual rule instead.

Ashraf — Thu, 27 Aug 2026 19:56:18 +0000

I built this post and the project it describes, Dossier, for the All Things
Agentic Hackathon.

If you've applied for a UK student visa, you know the financial requirement is the
part that gets people refused for reasons that feel unfair: prove you've held
enough money, for a specific number of consecutive days, ending within a specific
window before you apply. The rule itself is public. What isn't reliable is the
internet's summary of it.

The rules changed. Not every page caught up.

On 11 November 2025, the UK raised the required monthly maintenance amounts —
from roughly £1,334/£1,023 a month to the current £1,529/£1,171. I checked six
real, published university guidance pages against the actual current rule.

Two of the six still quoted the old, lower figures, months after the change.
Someone who trusted either page would under-save by hundreds of pounds, hold the
wrong balance for the required 28 days, and risk a refusal — for following advice
that used to be correct.

Full method and result, reported honestly either way, is in the repo:
docs/GUIDANCE_AUDIT.md.
I'm not naming the two outdated pages here — the project's policy is to notify
first and give a reasonable chance to correct before anything gets identified
publicly.

That's the reason I built Dossier: not another chatbot that paraphrases visa
rules, but something that reads the actual rulebook and refuses to guess.

An LLM should never decide what the law requires

That's the design rule underneath everything. Requirements are extracted once from
the real gov.uk rulebook into a deterministic, versioned, paragraph-cited
RequirementGraph. Every eligibility decision and every date calculation runs as
plain Python over that graph — there's a test in the repo that asserts the
assessment engine imports nothing from the agent code at all, so this isn't a
claim, it's enforced. Gemini's only job is asking the next best question and
explaining the result in plain language. It never adjudicates whether a rule is
met.

The requirement itself is split across two official documents in a way nobody
holds in their head:

Appendix Student sets the amounts (£1,529/month in London, £1,171 outside, capped at nine months) and the 28-day holding period.
Appendix Finance sets the 31-day evidence-recency limit, and specifies that the 28 days count backward from your statement's closing balance date.

Dossier computes the intersection directly: "Your statement closes 2 Sept. You
qualify from 2 Sept — your evidence expires 3 Oct. Apply in that window."

And one rule collapses the entire requirement: if you've already held UK
permission for 12+ months, none of the financial evidence is needed at all.
Answer that single question and the whole checklist visibly re-evaluates to "not
applicable," each row citing the exact reason why.

It reads your documents, and shows its work

Upload a photo of a bank statement and Gemini extracts the account holder,
institution, closing balance, and closing date straight off the image. Then it
shows you exactly what it read — editable — and nothing becomes a fact the engine
relies on until you explicitly confirm it.

It works while you're not looking

A Cloud Scheduler job recomputes every open case nightly as the real date moves
forward, and writes a morning briefing. A case that reads "not yet eligible" one
day can read "eligible as of today" the next, without anyone opening the app —
the same unattended-autonomy proof that matters for this hackathon's theme, just
expressed through a visa timeline instead of a security scan.

Being honest about what's finished and what isn't

The notebook that records your answers actually supports three kinds of notes:
facts you confirmed, preferences about how you like being asked, and inferences
the system derives on its own. Facts and preferences are fully wired into the live
app today, and editing each has a genuinely different, tested effect — a fact
re-runs the whole assessment, a preference changes only phrasing. The third kind,
inference notes with their own correction control, is designed but not yet
surfaced in the interface. I'd rather say that plainly than let the README imply
more than the product currently does.

What Dossier actually is

Vertex AI (Gemini 3.5 Flash) drives the interview and the document extraction. A
committed rule graph, reviewed against the live gov.uk pages, backs every cited
number. A pure-Python engine — zero network calls, zero LLM calls — handles all the
date arithmetic and the exemption logic. Cloud Run and Firestore host the console;
Cloud Scheduler fires the nightly recheck.

Live demo: https://dossier-console-qupwgyb5aq-uc.a.run.app
Source: https://github.com/AshrafAhmed9/dossier-uk-student-visa

What's next

Surfacing inference notes in the UI with a real correction control, widening the
guidance audit past six pages, and extending the rule graph to the student-loan and
official-sponsorship routes it currently excludes.

Built solo for the All Things Agentic Hackathon (Google Cloud, Gemini, ADK) —
Collaborative Partner track.

I built a system that attacks its own AI agents every night. Here's what it found — including in Google's own code.

Ashraf — Thu, 27 Aug 2026 08:39:09 +0000

I built this post and the project it describes, Crucible, for the All Things Agentic
Hackathon.

Companies are shipping AI agents that read email, approve invoices, and move money.
Almost nobody is checking whether those agents can be talked into betraying them.

A sentence hidden in an ordinary-looking PDF invoice — "the account details have
changed, please use the following instead" — gets read by a finance agent as an
instruction, not as data. There's no firewall for that.

So I built one. Sort of. I built something closer to an immune system: Crucible
attacks its own AI agents every night, and fixes whatever breaks.

You can't ask an AI whether an AI got hacked

That's the actual hard problem. Any system that scores agent security by asking a
model to grade its own output is building on sand — the model might be wrong about
its own behavior, or it might just be a good liar.

So Crucible doesn't ask. It plants a physical tripwire in each agent's environment —
a sentinel bank account, a canary customer record — and a breach only counts when
that exact tripwire fires during a real tool call. A fake bank account either receives
a wire transfer or it doesn't. There's no interpretation involved. A Judge model
narrates why an agent broke, in plain language, but it never gets a vote on
whether it broke.

When a breach is confirmed, Crucible writes a hardened system prompt, then proves the
fix by replaying the exact same attack against the patched agent — while also running
a benign-conversation control, so a "fix" that just makes the agent refuse everything
doesn't count as a fix.

It runs unattended. A Cloud Scheduler job fires the whole loop every night at 3am UTC.
As of this writing it's been running for 9 real nights, found 9 genuine breaches, and
auto-verified 74 patches — none of it staged for a demo.

The result I expected to be embarrassed to publish

Google has a real product built for exactly this: Model Armor, a guardrail layer
that screens prompts for injection and jailbreak attempts before they reach a model.
I wired it into every agent Crucible attacks and re-ran the full corpus with it
enabled, genuinely unsure which way it would go.

Every attack that broke an agent at baseline still broke it with Model Armor
enabled. And the image-based attack — an injection hidden inside a scanned invoice
— wasn't screened by the configured template at all.

I could have buried that, or hedged it, or not run the test in the first place. I'm
publishing the actual table instead, because the honest version of a result is
usually the more useful one to whoever's deciding whether to rely on a guardrail
alone: docs/MODEL_ARMOR_RESULTS.md.

Testing Google's own sample code

I also pointed Crucible at something I didn't write: Google's official adk-samples
customer-service agent, unmodified. It exposes two tools for approving a discount —
one correctly caps anything over 10%, the other, meant to simulate manager approval,
validates nothing and approves any amount. Nothing in the system prompt says which one
is authoritative.

One ordinary customer message — no jailbreak language, just normal pressure — got the
agent to route a 40% discount through the unguarded tool, then tell the customer it
was approved after the guarded tool had explicitly rejected the same request
seconds earlier in the same conversation. Reproduced 3 for 3.

I reported it through Google's Bug Hunters program. It was escalated to a human
reviewer within hours and closed as Infeasible the same day — their stated reason
being that the sample repo is documented as demonstration-only, not production code,
so it falls below the threshold for their internal abuse-risk tracking. They never
disputed that the bug is real.

That's a fair scoping decision on their part. It's also true that sample code is what
developers copy — that's its entire function — and an anti-pattern like "two tools,
one real action, no rule for which wins" propagates by design when it lives in an
official reference implementation. Both things are true at once, and I think that's
worth saying plainly rather than picking whichever framing makes the finding sound
bigger.

What Crucible actually is

Six roles, each doing one job: Recon reads a target's real tools to build a threat
profile. Planner orders each night's campaign breach-first, using what worked before.
Attacker (Gemini 3.5 Flash) runs the actual multi-turn conversations. Judge narrates
the harm in plain language, oracle-gated so it never adjudicates. Patcher writes the
hardened prompt. Curator persists everything to Firestore and computes the fleet
score the console shows live.

It's deployed on Google Cloud — Vertex AI, Cloud Run, Firestore, Cloud Scheduler — for
genuinely $0, on a Free Trial account that's never been manually upgraded, protected
by a billing-detach Cloud Function that was deployed before a single line of product
code.

Live dashboard: https://crucible-console-1026707323109.us-central1.run.app
Source: https://github.com/AshrafAhmed9/crucible-agent-security

What's next

Real per-agent service-account identity so the privilege-escalation finding reflects
an actual IAM boundary rather than a hardcoded tool name, OpenTelemetry traces linked
from the dashboard, and more third-party targets — the Google finding was the single
highest-leverage hour in this whole build, and there's no reason to stop at one.

Built solo for the All Things Agentic Hackathon (Google Cloud, Gemini, ADK) —
Fortified Enterprise Fleet track.