PromptGuard detects threats across six categories of environment-driven attacks against autonomous AI agents, covering 21 distinct attack vectors.
Coverage by category
Availability by tier
How detection works
Each detector follows the existing InjectionDetectionProvider pattern:
- Heuristic detectors (HTML, Markdown, critic evasion, few-shot, font, memory, sub-agent, persona) use regex/pattern matching and run on every request at negligible latency cost.
- LLM-judge detectors (framing bias, RAG poisoning) use a heuristic prefilter first, then escalate to an LLM call only when the prefilter fires. This caps LLM cost to the population of suspicious requests.
- Multimodal detectors (image/audio stego, adversarial patch) operate on media attachments via the
media field on the Guard API.
- Systemic correlators (sybil, fragment, cascade, collusion) run as a background service that reads from
security_events, not on individual requests.
All detectors are surfaced through the same dashboard, audit log, and webhook infrastructure as existing threat types.
API integration
The Guard API accepts two new optional fields for agent-traps detection:
Both fields are optional and backwards-compatible.
On Scale and above the multimodal detectors are live on the media field, so a request carrying a base64 attachment can come back with decision: "block" and a threat_type of image_stego, image_adversarial or audio_stego — outcomes that were not reachable before. When that happens the event metadata carries media_provider and media_part_index, naming exactly which attachment to drop or re-encode; you do not have to guess which of several parts tripped it.
Parts that supply only a url are not fetched server-side and therefore are not scanned. If you want an attachment inspected, send it inline as base64. A url-only part passing is not a verdict of safe — it is an absence of one.
Further reading
For the academic research behind these threat categories, see the PromptGuard blog. 
