SAAF × TAGSecurity Challenge
● Tue 10 Nov 2026 · Mollie, Amsterdam

SAAF Security
Challenge

Help secure our agents. A one-day hackathon where auditors, builders and security specialists attack the open-source agents of the Shared Audit Agents Framework, find what breaks, and build the defences.

RegisterHow it works
02 Trace

Every decision,
a thread you can follow

Each tool call, retrieved document and model output is kept as evidence: its input, its source, its hash. An auditor can pull any thread and walk it back to where it started.

EU AI Act · Art. 12 Record-keeping: automatic logging of events over the system's lifetime.

03 Harden

Agents gone rogue,
caught early

Red teams, security specialists and curious builders go after the agent repos before anyone relies on them. Each weakness is reported, traced to its source and turned into a test that protects every agent. On 10 November at Mollie, red teams from Prosus and Skuridat attack the agents live and explain what needs fixing; the builders in the room then build the defences, across the whole repository.

  • Prompt injection hidden in evidence documents queued
  • Misuse of tool permissions queued
  • Bypassing the human checkpoint queued
  • Leaking secrets through outputs queued

EU AI Act · Art. 15 Accuracy, robustness and cybersecurity, including resilience against attempts to alter use or outputs.

04 Oversee

Oversight you
can sign off on

Hardened agents come back to a single view: every thread accounted for, every control closed, and a human with the final say.

EU AI Act · Art. 14 Human oversight: people can understand, monitor and override the system.

SAAF Security ChallengeHelp secure our agentsHackathon · red team, build, defend
Tue 10 Nov 2026 · 09:00–17:30
Mollie · Amsterdam (address shared after approval)
About 100 auditors, builders and security specialists
SAAF has ties to NOREA, ISACA, the IIA and NBA
Brought to you by
SAAFMollieTAGProsusSkuridat
RegisterSAAF Agent Library
TrackShared Infrastructure
TrackGlobal Internal Audit Standards
TrackEvidence Collection
TrackCompliance & Regulatory
TrackReporting Visualization
TrackGovernance & QA
● Co-hosted by

This is TAG

TAG stands for To Achieve Greatness. A community of builders, hackers and creators in Amsterdam. Not desks and WiFi: a house where people ship every month, show what they built, and do it again.

For this challenge TAG brings its builders to Mollie, so the room is a mix of auditors and developers. If you like how that feels, you can be part of it: an ever growing community of builders and shippers, with events like this one every month.

Tag inSee what else happens at TAG
● Organised by

This is SAAF

The Shared Audit Agents Framework: an open framework for auditing, testing and hardening the AI agents that now sit inside audit, risk and compliance work. Built in hackathons by auditors, engineers and ethical hackers, with ties to NOREA, ISACA, the IIA and NBA.

Visit SAAF