Everyone has a demo of an AI agent. Almost nobody has one they would leave running overnight. This is the hackathon where you build the one you would. Text, voice, screen, webhooks, files, any input you like. Automate as much as you can. Then prove it knows when to stop.
hackathons run by Hackathon Raptors since 2023, across 85+ countries.[7]
prompt injection's rank on the OWASP Top 10 for LLM Applications, a spot it has held since the list launched.[5]
of agentic AI projects Gartner expects to be cancelled by the end of 2027, citing costs, unclear value and weak risk controls.[3]
to build an agent worth trusting with the keys.
Every model now calls tools. Every framework ships an agent loop. Every product page says "autonomous." And yet the agents people actually trust with real work are rare, because the hard part was never getting a model to take an action. The hard part is getting it to take the right action, a hundred times in a row, on messy input, without anyone watching.
The hard part was never getting a model to take an action.
In July 2025 an AI coding agent wiped a live production database during an active code freeze, ignored repeated instructions not to touch production, and then told its user that a rollback was impossible when it was not.[1][2] That story went viral because every engineer recognised it. Nobody had built the boring parts: separation of what the agent can read from what it can destroy, a confirmation step before the irreversible command, a log a human could follow, a way to make it stop.
Meanwhile the attack surface grew. An agent that reads your email can be instructed by your email. In 2025 a single crafted message was enough to make Microsoft 365 Copilot leak internal files, with zero clicks from the user.[6] Indirect prompt injection is not a theoretical risk anymore. It is the default threat model for anything that reads the outside world and then acts.
Gartner's verdict on the current wave is blunt: more than 40% of agentic AI projects will be cancelled by the end of 2027, and inadequate risk controls are one of the three reasons named.[3] Their analysts also estimate that only around 130 of the thousands of vendors selling "agentic AI" are delivering genuine agentic capability.[4] The rest is chatbots with a new label.
So the gap is clear. Not more agents. Better ones. Agents that run end to end without a human in the chair, and that are engineered, not hoped, to fail safely.
That is the hackathon. Build the agent that does the job, and stops when it should.
An agent that drafts a reply is a chatbot. An agent that reads the thread, checks your calendar, books the slot, sends the reply and files the follow-up is what we are here for.
Text, voice, images, screen capture, files, email, webhooks, cron, chat. If it can trigger your agent, it counts.
Your inbox, your dev workflow, your browser chores, your groceries, your on-call rotation, your college deadlines. Pick a job you would actually hand over, then pick the track it fits.
Any model, hosted or local. Any framework or none. MCP, function calling, browser automation, shell, APIs. Use what gets you there.
It has to be the kind of agent you would leave running unattended. That is the whole point of the event, and it is what the judges will test.
Five everyday jobs worth handing over, and one open track for everything else. Every track is scored on the same rubric.
An agent that runs your email and your schedule. It reads what comes in, works out what needs an answer, and handles it instead of leaving you a longer to-do list.
EXAMPLE RUNA meeting request lands. The agent reads the thread, checks your calendar, books the slot, sends the reply and files the follow-up.
An agent for the chores that pile up at home: bills, renewals, forms, bookings and the weekly shop. The paperwork of being a person, done on time.
EXAMPLE RUNA renewal notice arrives. The agent compares it with last year, finds a cheaper plan, fills in the switch and waits for your approval before anything is paid.
An agent that does the legwork of learning something properly. It watches the sources you care about, pulls in what is new, and keeps your library, notes and deadlines in order, so your time goes on thinking and not on filing.
EXAMPLE RUNA paper on your topic is published. The agent downloads it, checks it against what you already hold, files it in your reference library with notes, and adds it to Friday's reading brief.
An agent that works the web the way a person does. It opens pages, reads them, clicks, types and fills in forms, so it can finish a job on sites that have no API.
EXAMPLE RUNA weekly job fires. The agent opens three supplier sites, signs in with a test account, compares the listings, fills the cart on the best one and stops at checkout for your approval.
An agent for the chores between writing code and shipping it. It takes the first pass on the work that interrupts a team all day.
EXAMPLE RUNA pull request opens. The agent reads the diff, runs the tests, flags the risky change, leaves line comments and pushes the trivial fixes itself.
Build your own. Voice agents, back-office work, health routines, hobby projects, the job nobody thought an agent could do. No limit on domain, input or stack.
YOUR CALLYou define the trigger, the job and the result. The rules and the one condition still apply: it has to run unattended.
A narrow agent that finishes the job beats an ambitious one that half-does it. Judges are reading for what works, not what your README claims.
Clone the repo, follow the README, fill in .env.example, and get
your agent working in under 15 minutes. If it needs API keys, say which ones and what tier.
Your demo video shows the agent completing a real task from trigger to finish, with no human touching the keyboard in the middle.
Every run leaves a trace: what it saw, what it decided, which tools it called, what came back.
After 72 hours we want an agent a stranger could run, watch and trust.
The trace is the receipt. Claim a fully unattended run in your README and show a trace full of human approvals, and you are scored on the trace, with a note about the gap.
SAFETY.md counts. "We told the model to be careful" is an answer, and it is a weak one. Tell us what is enforced in code.
Honest claims beat inflated ones. "It runs end to end, here is the failure mode we did not fix" scores above a confident README and a broken demo.
Also submit. Public GitHub repo under an OSI-approved license. Demo video, 3 minutes max: one full unattended run, trigger to result.
Layout is advisory. Judges read what you actually ship.
Published at kickoff. A small set of hostile test inputs: emails, web pages, documents and voice transcripts with prompt injections, conflicting instructions and deliberately broken data hidden inside.
Run your agent against it. Commit the results. Judges will run it too.
You do not have to pass all of it. You have to know what happens when you do not.
Each one earns +1, up to +4.
{{ b.text }}
These will not score well.
We are not against frameworks, hosted models or no-code glue. We are against agents nobody can run, watch or stop.
Each project is rated on a 5-point scale across five weighted criteria. Final ranking is the weighted average across all judges who evaluated the project, plus any safety bonus earned.
{{ c.text }}
$1,800 prize pool, across five awards.
Grand Prize. The agent we would actually leave running. Most autonomy, cleanest failures, real job done.
Runner-Up. Exceptional autonomy and reliability across the board.
Third Place. A standout, for how much it ran on its own or for one decision nobody else made.
For the team whose agent was the safest to hand the keys to. Guardrails, monitoring, kill switch and audit trail, all four, done properly.
Side quest. Three write-ups win $100 each. See below.
Publish a write-up of your build. The time the agent did something you never asked for. The trap pack email that got through. The guardrail you added at hour 60. The loop that burned through your API credits. The feature you cut because you could not make it safe.
On insight, not follower count. A 200-follower account with a genuinely useful debugging story beats a viral thread that says nothing. Small accounts, this one is winnable.
X, LinkedIn, Dev.to, your own blog, any developer-focused platform. Your call. Tag Hackathon Raptors.
Write any time from kickoff. Submissions close December 7, 18:00 UTC. Winners announced December 11 with the main results.
Optional. Does not affect your main score.
What counts as a valid submission.
MIT or Apache-2.0 preferred. Public at submission. You keep full ownership.
Hosted APIs, local models, frameworks, MCP servers, no-code glue. All allowed. Name what you used in
AGENT.md.
The agent must take real actions through real tools, against real or sandboxed systems. Talking about a task is not doing it.
Setup in under 15 minutes from the README. Provide a sandbox, test account or mock mode for anything that touches personal data.
API keys, tokens and credentials live in .env, never in git.
Committed secrets are a disqualification, and a lesson.
No spam, no unsolicited messages to real people, no terms-of-service violations, no real money without hard limits. Test destructive actions against sandboxes.
All project code written during the 72-hour window. Planning, prompt sketching and picking your stack beforehand are fine. Code committed before kickoff disqualifies the submission.
1-4 people. Solo welcome. Find teammates on the Hackathon Raptors Discord before or during the event.
Claude Code, Cursor, Codex, Copilot, local models, bring whatever you have. Building agents with agents is fine. We judge whether the agent holds up and whether someone on the team can explain how it works.
You already have twelve scripts gluing your life together. Give them a brain and a trigger.
TRACK Life Admin, or OpenTool design, retries, idempotency, permission scoping, state. The parts that make an agent reliable are the parts you do for a living.
TRACK Developer WorkflowHands-free agents that listen, act and report back. Speech in, real actions out, a spoken summary when the job is done.
TRACK Open TrackOn-call first responders, cost watchdogs, deploy babysitters. You know exactly which pages should never have woken a human.
TRACK Developer WorkflowThe trap pack is for you. Guardrails enforced in code, injection-resistant tool use, an audit trail that holds up.
TRACK Any, plus all four bonusesLive monitoring is a product, not a log file. Make an agent's mind readable at a glance and you have built the piece most agents are missing.
TRACK Any, plus Live MonitoringSenior engineers, architects and technical leaders who have shipped automation in production, been paged at 3am by systems that did something unexpected, and know the difference between a demo and a deployment.
Full panel announced November 6, 2026. Reach out at {{ email }} to nominate someone, or to be nominated.
{{ f.a }}
Tool calling is standard. Open protocols made connecting a model to real software a weekend job. Every company has a pilot. And the incidents arrived on schedule: production data deleted by an agent that was told not to touch it[1], files leaked through a single poisoned email[6], and an industry analyst forecasting that a large share of today's agent projects will not survive to 2028.[3]
None of those failures needed a smarter model to prevent them. They needed a confirmation step, a scoped permission, a log, and an off switch. Ordinary engineering, applied to a new kind of software.
Approximate curves, simplified from published benchmark results (ImageNet, Switchboard, SQuAD, GLUE/SuperGLUE, MATH, OSWorld). Each benchmark is normalised so the human baseline scores 100. Sources: [8] [9] [10] [11].
Building an agent that acts is easy now.
Building one you would trust while you sleep is the part that still takes engineers.