Our team, Octopus, took first place overall at the inaugural Anthropic × Kaszek hackathon in Latin America, held in 2026 with Digital House as co host. Five of us built a prototype called AgentPay over the course of the event: Ignacio Aracena, Nicolás Spagnuolo, Mauro Proto Cassina, Sebastián Buffo Sempe and me.
The project received an event prize, not an investment or funding round. This is a first-person account of the prototype and team. The organizer’s event page documents the hackathon, and the AgentPay repository provides the technical artifact.
It was a mixed team. Three of us were students from UdeSA: Ignacio, Nicolás and Mauro. The other two were senior profiles, Sebastián from the business, fintech and startup side, and me from tech, product, fintech and cybersecurity. The three students carried a lot of the weight. They came prepared for a demanding format with little time to explore long paths, and they shaped both the build and how we framed the problem. To use the time well, we split into fronts: Ignacio, Nicolás and Sebastián on business, value proposition and the pitch, Mauro and I on the technical prototype.
What is AgentPay?
AgentPay is a functional prototype we built during the event. It shows how to add a security layer over AI agents when they take sensitive actions: payments, credentials, files, connections to external services.
The idea came out of a problem I've been working on since February, when I started building Oktsec. Agents no longer just answer questions. They read files, run commands, use APIs, connect to internal tools, install dependencies and operate with credentials. That opens a concrete question for companies and technical teams: how do you control what an agent does before it executes something risky?
Prompt injection is already a risk
It's a real risk today, not a future scenario. The pattern is documented: Invariant Labs showed in April 2025 how hidden instructions inside an MCP tool description, read by the model but not shown to the user, could make an agent read sensitive files and send them out while the interface showed a harmless summary. Once the model is connected to tools, files or commands, a malicious instruction stops being text and becomes a concrete action.
The old risk was that AI gave a wrong answer. Now that agents can read files, use tools, reach data or run commands, an attack can do real damage: steal sensitive information, execute orders, compromise systems. A lot of companies are going to have to treat these agents like identities with privileged access. Limit what they can do, review their actions, keep evidence and not let them operate with full permissions unsupervised.
How AgentPay checks a payment
AgentPay ran a deterministic security pipeline in front of each payment, checking it before the action executed. It took the problem to one concrete case: the payments an AI agent executes. We built a Claude Code plugin that ran inside the agent's flow and inspected supported tool calls routed through the plugin before allowing them to proceed. We didn't start from zero. We reused prior Oktsec work on risk detection, analysis of agent environments and control of sensitive actions.
The prototype ran a security pipeline before executing a sensitive operation. It checked for exposed credentials, amount limits, frequency, recipient changes, altered parameters and signs of external manipulation. If the agent wanted to pay USD 50 to someone but a compromised MCP server changed the recipient or inflated the amount before the operation ran, AgentPay could catch the change, block the action or ask for human approval.
One decision mattered more than the rest. We did not base the security on asking another model whether something was safe. AgentPay used deterministic rules, which are more predictable and auditable, to decide whether an action could proceed, be blocked or be flagged as risky. In financial flows that's the whole point. You don't want a hallucination or a malicious instruction to be what enables a transaction.
It also left auditable evidence. Each decision was recorded with a hash chain, so you can go back and see what was attempted, which rule applied and why it was allowed, blocked or sent for approval.
Applying the pattern beyond payments
Beyond payments, AgentPay matters because of the pattern underneath it. As agents start operating on real tools, companies need a control layer before, during and after each sensitive action. More and more teams are exploring AI agents, but to use them in sensitive environments they need visibility into what agents do, clear rules, traceability and evidence to review afterward.
That line of work continues past the hackathon. AgentPay was the working prototype, applied to the payments agents execute. Oktsec, the project I'm building now, is the continuation of that line: a security layer around AI agents in real environments that defines what they can do, under what rules, with what permissions and what evidence their actions leave behind.
It doesn't replace the models or compete with AI tools. Execution stays under the customer's control, with data handling determined by the configured tools, model providers and destinations, and the layer adds visibility, rules, control and evidence that tech, security, compliance or leadership can review.