Caveo: the accounts-payable agent that can't be phished. Every invoice, attachment and vendor link is opened in a throwaway Vultr sandbox, read by a vision model, checked against the vendor portal and vendor master, and held for human approval. Booby-trapped files and prompt injections get contained, flagged and destroyed. Challenge 1: Blast Radius Zero.