AI Firewall
Zero-trust protection for agentic AI systems. One API key. Direct HTTP endpoints. Six layers of defense.
One API key. Direct HTTP endpoints. Six layers of defense across inbound prompts, agentic tool returns, MCP schemas, and memory vectors.
# Example Health Check (cURL)$ curl https://synaptosec.com/health→ { status: 'ok', app: 'AI Firewall', version: '0.4.0' }What it protects against
Five threat categories targeting modern autonomous agents, tool pipelines, and long-term stores.
1. Prompt Injection
Direct jailbreaks, indirect injection via retrieved RAG context, multi-turn state drift, multilingual evasion, and instruction-override tokens.
2. Agentic Attacks
Tool result indirect injection, MCP tool schema poisoning, covert API parameter relays, and confused deputy privilege escalation.
3. Memory & Context Poisoning
Gradual fact poisoning across persistent agent sessions, anomalous cluster formation in embeddings, and dormant triggers (MINJA).
4. Data Leakage
System prompt extraction, API key leakage, sensitive PII exfiltration, and encoded credentials hidden in generated URLs.
5. Denial-of-Wallet
Token-burn attacks, recursive generation loops, uncontrolled sub-agent spawns, and rate-cap exhaustion exploits.
How it works
Inspect the sub-millisecond execution lifecycle across all six inspection tiers.
Live Execution Loop
Interactive Signal Flow Simulation
Deterministic Prefilter
Pattern Matching
Obfuscation Decoding
Linguistic Analysis
Semantic Classification
LLM Guard Sandbox
Prefilter + linear decoders passed. Safe payload dispatched to agent context.
Microsecond Latency Breakdown
Clean Path (0.050ms) vs Fast Block (12μs) Microsecond Profile
Benign query cleared by the deterministic prefilter without semantic escalation
Deterministic pattern match halts the attack immediately (linear-time, no ReDoS risk)
// Data condition: single node, our load test (Amsterdam, 2026-09-29). Cache defeated. Not a universal guarantee.
Threat Matrix Coverage
Layer-by-Layer Attack Defense Matrix
| Attack Category | Prefilter | Patterns | Decoding | Linguistic | Semantic | LLM Guard | Agentic |
|---|---|---|---|---|---|---|---|
| Direct prompt injection | ○ | ● | ● | ● | ● | ● | · |
| Indirect injection (RAG) | · | ● | ● | ● | ● | ● | ● |
| Tool result injection | · | ○ | ● | ● | ● | ● | ● |
| MCP tool poisoning | · | ○ | · | ○ | ● | ● | ● |
| Memory poisoning (MINJA) | · | · | · | ○ | ● | ● | ● |
| Multilingual (DE/FR/ES/NL/IT) | ● | ● | ● | ● | ● | ● | · |
| Held-out novel variants | · | ○ | ● | ● | ● | ● | ● |
| Worm propagation | · | ● | · | ● | ● | ● | ● |
| Obfuscated / encoded | ● | ● | ● | ● | ● | ● | · |
| System prompt extraction | ○ | ● | ● | ● | ● | ● | · |
| PII / secrets leakage | ● | ● | ● | ○ | ● | ● | ● |
| ReDoS filler | ● | ● | · | · | · | · | · |
// Data condition: internal corpus (712 attack samples, 700+ benign controls; 0 false positives, 95% upper bound ≈ 0.4%).
Public Benchmark: deepset/prompt-injections
Public Benchmark Performance: deepset/prompt-injections
// Data condition: external benchmark (deepset/prompt-injections: current 662 public samples — 263 injection-labelled, 399 benign — none authored by us; measured 2026-10-08). Published as measured: 66.5% raw recall, 0 of 399 benign flagged. Content-policy attacks are a documented out-of-scope boundary.
Threat Evolution (2024–2026)
Documented Threat Lineage: 2024 – 2026
Sleeper Agents
Anthropic (arXiv:2401.05566)
Models trained with deceptive backdoors that persist through safety fine-tuning.
Poisoning Attacks on LLMs
Anthropic / UK AISI / Turing
Demonstrated targeted data poisoning persisting across fine-tuning epochs.
MINJA (Memory Poisoning)
Security Research / arXiv:2503.03704
Cross-session poisoning of long-term memory vectors to hijack future agent decisions.
OWASP LLM01:2026
OWASP Top 10 for GenAI
Standardized taxonomy for indirect prompt injection via untrusted tools, RAG & MCP.
Guardrail Sabotage
Constitutional Classifier Study
Payloads designed to selectively silence intermediate classifier safety hooks.
PoisonBench Standard
ICML 2026 Benchmark Suite
Standardized multi-agent evaluation corpus for tool and memory corruption.
// Data condition: academic literature and published security benchmarks (Anthropic, OWASP, ICML, arXiv).
Eight agentic defense mechanisms
Dedicated isolation and verification primitives for autonomous multi-step pipelines.
Tool Guard
Enforces provenance gating with RAG_UNTRUSTED class before feeding external tool output back into agent context.
MCP Guard
Validates Model Context Protocol (MCP) tool registrations, schema definitions, and JSON-RPC messages against shadow parameter exploits.
Dual-LLM Sandbox
Isolates untrusted data summarization in an air-gapped non-agentic model instance. Benchmark publication pending.
Chain Logger & Relational Detection
Immutable audit trail with relational chain detection tracking multi-hop agent invocations, tool parameters, and verdicts.
Silent API Relay & Fingerprinting
Fingerprints upstream API payloads to stop confused deputy exploits where malicious RAG context covertly triggers secondary webhook pings.
Worm Propagation Containment
Isolates autonomous agent-to-agent recursive infection vectors and cross-workspace viral payload execution.
Source Reputation with Decay
Maintains temporal trust ratings across data sources, APIs, and client IPs with exponential half-life decay.
Denial-of-Wallet Caps
Enforces hard token ceilings, recursion bounds, and budget circuit breakers to stop token-burn billing drainage attacks.
What AI Firewall does not do
Security claims require unambiguous architectural boundaries. We document where our inspection begins and where it stops.
Model weight backdoors: We don't detect backdoors in model weights. We detect behavioral symptoms at runtime.
Chat template backdoors at inference: We don't detect chat template backdoors at inference. We protect the runtime payload stream.
Hidden chain-of-thought: We don't read hidden chain-of-thought. We detect symptoms, not intent.
Cross-modal defense: We don't do cross-modal defense. Audio, image, video steganography are currently research-stage.
Market scope: We don't claim to be the only AI firewall. Lakera, Prompt Security, Fortinet, and Palo Alto cover other layers.
// We publish what we don't cover. That's how you know what we do cover.
Verified numbers
Production numbers measured directly on our single-node EU-hosted load test (Amsterdam).
| Metric | Value |
|---|---|
| Internal attack samples | 712 |
| Benign validation corpus | 700+ |
| External benchmark (deepset) | 66.5% raw |
| OWASP ASI corpus (safelabs-eval) | 0 VULNERABLE / 0 FAIL |
| Clean path latency | 0.050ms |
| Fast block path latency | 12μs |
| Sustained throughput | 100 RPS |
| Persistence crash-window | 5s |
// Measured on single node, our load test. Not a universal guarantee.
Full lifecycle features
Across our production runtime today: training audit and chat template verification. Export of injection-aware security events in standard formats (e.g. OpenTelemetry): coming soon.
Memory poisoning, MINJA staging, cross-session coordination, graph topology detection.
Corpus statistics, clean-label backdoor scan, async batch jobs, executive PDF reports.
GGUF sidecar parsing, Jinja2 structural analysis, token sidecar remap detection.
Export of injection-aware security events in standard formats (e.g. OpenTelemetry), with MITRE ATLAS mapping on every event.
Documented research-only status with the exact architectural trade-offs why it is not placed on the sub-millisecond hotpath.
Deploy AI Firewall in your pipeline.
Direct HTTP API and transparent reverse-proxy endpoints. SDKs: coming soon.