The attacker writes to what the agent reads, not to the agent.
One line hidden in a support ticket, an email or a web page can take control of an agent. AvertGate inspects both the incoming content and the action that follows it.
Decision flow
Session flagged
get_ticketresult · 1.2 KB- Hidden instruction found
- Result flagged
- Following calls are watched
Two gates, one outcome.
Indirect prompt injection comes from content the user did not write. Tool results, retrieved documents and web content are the agent's untrusted channel.
Scan the response
The returned result is searched for hidden instructions, encoded text and similar signals.
Flag it
Poisoned content is flagged and written into the session context.
Stop the action
The next request goes through policy and egress scanning; an out-of-policy call does not run.
See it. Limit it. Prove it.
A hidden instruction stops at the gate.
In the same session the content is flagged first, then the call that depends on it is blocked.
- Hidden text. HTML comments, invisible characters and look-alike spellings are scanned.
- Semantic inspection. When enabled, ambiguous content is put to a classifier model.
- Fail-closed. If inspection errors or times out, the call does not run.
Audit trail
Every call in the live stream.
Take the rules out of code.
Allow, limit and approval rules per tool and argument live in a single YAML file. A change needs no redeploy.
- Deny by default. A tool that is not listed does not run.
- Argument limits. Fields such as amount, SQL and URL are bound to a rule.
- Human approval. Risky calls wait for approval in Slack.
Policy editor
The rule is written on one screen.
Every decision is recorded.
The decision, reason and rule id are linked with SHA-256; a record changed afterwards is detected.
- Reasoned decision. Every event carries the reason and rule id.
- Redacted arguments. Raw data never reaches the dashboard.
- Session trail. Calls in the same session are read together.
Session trails
Every session is traced end to end.
Audit trail
Blocked injection attempts, event by event.
Frequently asked
What is indirect prompt injection?
It is when an attacker hides instructions not in the agent's prompt but in content the agent will read (an email, a document, a web page).
Can it be fully prevented?
No scan catches every variant. That is why the request side has its own gate: even if poisoned content is read, an out-of-policy action does not run.
Does it replace existing guard tools?
We do not guard the chat layer; we guard the action layer. The two can be used together.
Guarantees
Four fixed principles behind every decision.
- 3 decisionsEvery call ends in allow, block or human approval.
- Fail-closedIf a check errors, the call is not run.
- SHA-256 chainEvents are chained, so any change after the fact is noticed.
- Your data stays with youTool calls and results never leave your network.
Put a gate in front of your agents.
Every deployment starts with a demo and a POC on your own agents.