c0rtex

Local. Private. Free.

• Personal AI assistant running entirely on local hardware — no API costs
• Python wrapper for Ollama + Qwen3.5, chat via Matrix
• Define a SOUL (system prompt), schedule tasks with cron
• ~30 tools: file ops, system monitoring, web browsing, CTF helpers, 3rd-party integrations
• All tools guardrailed — scoped dirs, auto backups, no raw shell

★ Class contribution: the base project was a pre-existing hobby. PR #4 on main is what we built for COMP 312.

Why This Matters

5 Layers of Defense

How We Tested It

• 6 attack pages — each disguised as a modular synth article
• Tested across 3 model sizes: qwen3.5:2b, 4b, 9b
• Run once with full mitigations, once with all layers stripped
• Each page plants unique marker strings — grading script checks if the model parrots them back

The Data

Overall defense rate by model

2b: 88% · 4b: 100% · 9b: 94% — all improved significantly with mitigations active

Defense rate by attack class

Hidden CSS hurt the 2b (67%). Social engineering fooled the 9b (50%). Blocklist bypass + tool abuse held across all sizes.

Status heatmap: test × model

3 failures across 54 tests. Content isolation wrapper stopped the majority of attacks.

Status breakdown per model

4b: clean sweep. 2b and 9b: isolated failures only.

What We Learned

• Defense-in-depth works — no single layer is enough, but stacking them measurably raised the bar
• Bigger ≠ safer — the 9b model fell for social engineering that the 4b blocked. More capable models are more persuadable.
• The content isolation wrapper did the most work — a simple tag outperformed more complex layers
• Social engineering is the hardest to defend — no trigger words, just persuasion. The most realistic real-world threat. The blocklist can't catch what it can't pattern-match
• All defenses ultimately depend on model behavior — no cryptographic enforcement Future: semantic filtering via secondary LLM, stronger content sandboxing

It's on GitHub.