All work

AI security / Case study

AgentShield

Check permissions before an agent acts.

Type
Open-source engineering
Release
v1.0.0
Stack
Python 3.12 · FastAPI · Pydantic v2 · CLI / SDK
Automated tests
49

System architecture

  1. Multi-Layer Prompt Injection & Context-Poisoning Detector
  2. Declarative Capability Policy Engine (agentshield/policy/engine.py)
  3. Egress Secret Redactor & Hash-Chained Audit Ledger
Three layers from the project’s architecture blueprint

01 / Problem

Why it exists

Autonomous AI agents connected to shell, filesystem, database, and HTTP tools are vulnerable to direct prompt injection, indirect RAG context poisoning, SSRF against cloud metadata services, and accidental credential exfiltration.

02 / Design

How it works

Enforce tool allow/deny policies, SSRF checks, path sandboxing, and egress redaction in a deterministic Python policy engine outside the LLM.

  1. Multi-Layer Prompt Injection & Context-Poisoning Detector

    Scans user inputs and retrieved tool outputs for instruction overrides, jailbreak framing, delimiter spoofing, encoded payloads, and zero-width characters.

  2. Declarative Capability Policy Engine (agentshield/policy/engine.py)

    Enforces allow, deny, and require_approval rules with built-in inspectors for shell, filesystem, network SSRF, and SQL tool arguments.

  3. Egress Secret Redactor & Hash-Chained Audit Ledger

    Scans outgoing responses for credentials/PII and appends every decision to a verifiable SHA-256 hash chain.

Deterministic Capability Firewall Outside the LLM Context Window
Context
Relying on system-prompt instructions alone ("never run destructive commands") fails when an agent ingests adversarial instructions from external documents.
Decision
Enforce tool allow/deny policies, SSRF checks, path sandboxing, and egress redaction in a deterministic Python policy engine outside the LLM.
Trade-offs
Requires declaring tool schemas and sandbox roots upfront, but guarantees deterministic enforcement even under complete prompt compromise.
Verification
Verified across 49 pytest tests and the 25-scenario OWASP 2026 evaluation suite.
Security and operational constraints
  • Evaluates only local agents, synthetic benchmarks, or explicitly authorized systems.
  • Untrusted context contamination automatically escalates high-risk tool calls from ALLOW to REQUIRE_APPROVAL or DENY.
  • Egress scanner redacts OpenAI/GitHub/AWS/GCP keys, JWTs, PEM private keys, database URIs, and Luhn-validated payment cards.
  • Every tool call is evaluated against explicit capability rules before execution; unpermitted tools are denied by default.
  • Any mutation or deletion of an entry in AuditLedger causes verify_integrity() to fail with the exact broken sequence index.
  • All 25 benchmark scenarios execute deterministically offline using safe synthetic payloads.

03 / Evidence

How to verify it

Repository-reported / OWASP 2026 Benchmark Suite

100% Recall · 0% FPR

25/25 exact verdict accuracy across 21 synthetic attack scenarios and 4 benign controls

Reproduce from the command line
git clone https://github.com/codesphere-u/agentshield.git
cd agentshield && pytest -v
python -m agentshield.cli evaluate
View source on GitHub
Next case study · Financial infrastructure FlowLedger Keep balances exact through payment retries.