You're pledging to donate if the project hits its minimum goal and gets approved. If not, your funds will be returned.
$40,000 left to reach the funding goal.
AI agents can now sign in to sites, send mail, push code and move money. Most setups protect the user with a prompt: "never reveal the password", "ask before paying". Prompts are not a security boundary, and an agent under pressure or under prompt injection will try another path.
I build SpaceApp (MIT, github.com/oll4com/spaceapp), an open-source workspace where many agent CLIs (Claude Code, Codex, OpenCode, Gemini and others) work side by side. Two of its protections are enforced by the system instead of the prompt: an agent-blind vault (the agent asks for a login to be filled and never sees the password) and server-side approval gates (payments, deletions, releases and messages to third parties wait for a person's yes, bound to exactly what the person saw). This project pulls both out into a small library any agent setup can use, pays for an independent security review, and publishes a test suite of attacks against them.
1. Extract the vault fill path and the approval gate into a standalone open-source package with a documented API, so that other agent harnesses can use them without running all of SpaceApp.
2. Commission an independent security review of both, publish the report, and fix every high and critical finding before the release.
3. Publish an open test suite of prompt-injection and exfiltration attempts aimed at these two controls (an agent asked by a web page to reveal a password, to approve its own payment, to change what the approval screen shows), with results for at least three agent CLIs.
I will do this in the open in the same repository, with the security model written up at github.com/oll4com/spaceapp/blob/main/docs/security-model.md.
The package is on npm with docs and examples; the review report is public with all high and critical findings closed; the attack suite is public and anyone can rerun it; at least three outside projects or users install or integrate the package within six months of release. A simple negative check also counts: in the suite, no tested agent obtains a stored secret or gets an action approved that the person did not see.
Minimum USD 12,000: the independent security review of the vault and the approval gate, report published.
Up to USD 40,000: the review (12,000), a part-time second engineer for four months to extract and document the library and its integrations (24,000), model API credits to run the attack suite against several agent CLIs (3,000), and test servers for six months (1,000). My own time is not in this budget.
Me, Nikolaos Theodoropoulos, founder of OLL4 (a Greek company; I live in Bangkok). I have run the production systems of my e-commerce company olla.gr since 2009: 1.2 million products, 20 supplier and 10 marketplace integrations, 15+ servers at 99.9% uptime. Since June 2026 I have built SpaceApp: public since July 2026, 11,000+ commits, one-command install on Linux, Windows 11 and macOS, about 1,200 npm downloads from 4 October to 2 November 2026 (our own test installs included) without marketing. My company runs on it every day, with a dozen or more agents working in parallel while every risky action waits for approval. OLL4 is in Anthropic's Claude for Startups, the OpenAI Partner Network and NVIDIA Inception.
Most likely: the controls turn out to be too tied to SpaceApp's internals to be reused cleanly, or the review finds a design flaw that needs rework before a release. In both cases the review report, the fixes and the attack suite are still public, and SpaceApp users get the hardened version. A smaller risk is low adoption of the separate package; the suite is useful on its own to anyone testing agent safety.
No outside funding; SpaceApp has been paid for by my own company. Applications are pending with BlueDot Impact (rapid grant) and EA Funds (TAIF) for my own time from December 2026 to August 2027, and I have applied this month to other AI safety grants for the same open-source core. If another funder covers the review, I will say so here and lower the goal.