Anyone whose agent reads text it did not write
Assume the model will be persuaded. Bound what follows.
Indirect prompt injection is not a bug to be patched. Any agent that reads external content can be given instructions by whoever wrote it. The durable defence is not better detection — it is making the compromised instruction unable to reach anything that matters.
Ask yourself
If your coding agent were told to read .env.production and post it to a webhook, what would stop it today?
Today
What you are working around
- Agents read tickets, PRs, web pages, and PDFs written by people you do not control
- The model cannot reliably tell instructions from data, and probably never will
- Detection classifiers can be evaded by anyone willing to iterate
- A single successful injection can reach every credential in the process
What changes
The specific difference
Authorization sits outside the model
The policy never consulted the model about whether the call was allowed, so persuading the model changes nothing about the verdict.
Policy EngineCredentials are not in the context to steal
The agent holds handles. Exfiltrating a handle to an unauthorized destination yields an opaque string.
SecretsEgress is allowlisted
Even a permitted read cannot be posted anywhere the policy did not sanction, matched at resolved-IP level.
Runtime SecurityDetection raises friction, it does not gate
An injection score annotates the trace and can escalate a call to human approval. It is never the only thing standing between an attacker and a secret.
Runtime Security
In detail
Why detection alone is the wrong architecture
A classifier on natural-language content is probabilistic, and the attacker gets unlimited attempts with immediate feedback. Any control whose strength depends on winning that race degrades silently as the attacks improve. A deterministic authorization decision on the resulting tool call does not — it either matched a policy or it did not, and rewording the payload does not change that.
What a successful injection actually costs
With the control plane in place, a successful injection produces: a denied call, a flagged trace, a deny-rate anomaly on that agent, and an audit record naming the attempt. That is not zero impact — the model was compromised and its output for that run is suspect. It is bounded impact, which is the property you can actually build on.
What we will not claim
Cirvix does not prevent prompt injection, and no product does. It does not make a compromised agent produce trustworthy reasoning. What it changes is the set of actions that reasoning can reach, according to the policies you configured.
Get started
Let the agents do real work.
Start with the free local scanner — it needs no account and tells you what is already ungoverned on your machine. Move to a governed runtime when you are ready.
Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.