Break an AI agent. Watch the gate hold.

Prompt injection can't be fully prevented in today's models, so the question that matters is what an injected instruction is allowed to do. Compose an attack, choose a tool for the agent to call, and a provenance-aware gate decides in real time — then maps the decision to MITRE ATLAS and the OWASP LLM Top 10. Everything runs in your browser; nothing is sent anywhere.

Compose the attack

Start from a known attack

Untrusted input the agent reads

Tool the agent proposes

Tool argument

Where the context came from

The gate decides

most-severe rule wins

Compose an attack and press Evaluate tool call.
The verdict and its framework mapping appear here.

How one decision is made

Detectors catch the obvious attacks, but detectors miss things. The real control is provenance: if untrusted content sits anywhere in the agent's context, nothing with side effects runs without a human — even when the pattern detector is fooled.

input

Untrusted text

step 1

Detect: injection · secrets · egress

step 2

Policy gate R0–R6

outcome

ALLOWREQUIRE APPROVALBLOCK

The seven rules

R0	Tool isn't declared in policy	BLOCK — default deny
R1	A secret (API key, token) is in the arguments	BLOCK
R2	Destination is a private/metadata IP or a non-allowlisted host	BLOCK
R3	Injection markers with a side-effecting tool	BLOCK · read-only allowed + alert
R4	Any untrusted content with a side-effecting tool	REQUIRE_APPROVAL
R5	A high-impact, destructive or persistence tool	REQUIRE_APPROVAL
R6	Trusted context, nothing flagged	ALLOW

Measured, not asserted

Fire all nine attacks at a naive agent, then at the gated one. Attack success rate is the honest metric — watch it fall to zero while benign work keeps flowing.