Screen prompt injection in agent inputs and tool results

SafePrompt checks every input, not just the first one

A chatbot reads one thing: the user's message. An agent reads many things it did not write. It pulls documents from a vector store, calls tools over MCP, browses pages and passes results between sub-agents. Every one of those is a place an instruction can arrive, and that is where modern attacks land. SafePrompt drops in at each checkpoint, so the whole pipeline is covered rather than the front door.

What are the three ways an agent gets injected?

SafePrompt reads the content at all three, so a hidden instruction has to get past a check before it can become an action. One gap today: it does not yet catch instructions hidden in an MCP tool description, so review the descriptions of every server you install.

How it scores against the benchmarks

On AgentDojo, a public agent benchmark, SafePrompt cut successful attacks from 239 to 4 out of 949. Screening tool output has a cost you can measure too. Under attack the agent finished its task in 131 of 949 runs with SafePrompt, against 400 undefended. With no attack planted, it finished 64 of 97 tasks with SafePrompt and 68 without.

Production API in strict mode, public sets 10 October 2026. AgentDojo: GPT-4o-mini agent, 21 to 22 October 2026.

Every per-case result is in the public repository.

Benchmark facts last reviewed: 26 October 2026

Install it in one function

Place the HTTP call before your agent reads untrusted text. Submit the exact tool result, retrieved chunk or inter-agent message. Authorize tool execution separately using the authenticated user and action arguments.

// Run on the server. Resolve endUserIp at your trusted proxy boundary.
async function screenText(text, endUserIp, timeoutMs) {
  if (typeof text !== 'string' || !text.trim() || !endUserIp ||
      !Number.isFinite(timeoutMs) || timeoutMs <= 0) {
    throw new Error('Invalid screening input')
  }
  const controller = new AbortController()
  const timer = setTimeout(() => controller.abort(), timeoutMs)
  try {
    const res = await fetch('https://api.safeprompt.dev/api/v1/validate', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-API-Key': process.env.SAFEPROMPT_API_KEY,
        'X-User-IP': endUserIp,
      },
      body: JSON.stringify({ prompt: text }),
      signal: controller.signal,
    })
    if (!res.ok) throw new Error('Screening unavailable')
    const result = await res.json()
    if (typeof result.safe !== 'boolean') throw new Error('Invalid verdict')
    if (!result.safe) throw new Error('Content withheld by screening')
    return { text }
  } finally {
    clearTimeout(timer)
  }
}

// Errors, malformed responses and timeouts must prevent the next model call.
const accepted = await screenText(toolResultText, endUserIp, applicationDeadlineMs)
await sendToolResultToAgent(accepted.text)

Estimate the checks in your agent loop

Each submitted text item uses a validation. A user message and four tool results need five checks before retries. Test exact serialized content, attacks and ordinary tasks together. SafePrompt checks each request on its own and does not track sessions. To have several turns judged together, send them in one check. Keep conversation state in your app.

Plan pricing · Coverage limits · Complete integration contract

It travels with your agent, across every provider

SafePrompt validates submitted text, so your app can place a checkpoint at each input boundary, whoever serves the tokens. Your pipeline can change providers without changing your security layer.

Use Azure Prompt Shields if your stack lives entirely in Azure. Use Bedrock Guardrails if everything runs in Bedrock. Use a model provider's own filter if one model serves your whole pipeline and the chat box is the only input you take. Agent pipelines usually span more than one of those. Our Azure Prompt Shields comparison sets the first of those choices next to ours.

Questions developers ask first