Known Limitations

We’d rather be upfront than over-promise. Here’s what Shadow AI does not do today, and how to work around each one where you can.

​

Certificate-pinned apps

Some native desktop apps pin their own certificate and reject any certificate they didn’t ship with — including the agent’s CA. Those apps bypass the inspection proxy entirely and are out of scope by design. We never silently fail open on a tool we do cover — pinned apps simply aren’t inspected at all, rather than being inspected unreliably. There is no device-side workaround; coverage there depends on the app vendor.

​

QUIC / HTTP-3

The agent intercepts HTTP/HTTPS through a local proxy. QUIC / HTTP-3 runs over UDP and can route around an HTTP proxy, so that traffic can reach an AI vendor without inspection. Chrome and some Google properties (including Gemini) prefer QUIC. Mitigation: disable QUIC via browser policy (for Chrome, the QuicAllowed=false enterprise policy). The browser then falls back to HTTPS over the proxy and inspection resumes. See Troubleshooting.

​

Multimodal coverage

The agent inspects more than prompt text. Alongside text extracted from PDF, DOCX, XLSX, and plain-text attachments, it now also forwards:

• Inline images — a screenshot of a credential pasted into ChatGPT, Claude, or Gemini is extracted and sent to the engine, which runs OCR server-side.
• Inline voice / audio clips — transcribed engine-side and scanned like text.
• Inline file attachments — a secret inside an attached PDF/DOCX/XLSX/text file is recovered and scanned like prompt text.

Two nuances to be aware of:

• Remote image references are not fetched. If a request points at an image by URL (https://…) rather than embedding it inline (data:…;base64,…), the agent does not download it to inspect it. Nearly all paste/upload flows embed the bytes inline, so this is an edge case.
• Media-bearing requests fail closed. Because image and audio bytes can’t be redacted in place, a request that carries media and trips a redact verdict is blocked outright rather than forwarded with a partial edit. Use an approved exception grant if you need to send it.

​

Coverage is a host allowlist

Shadow AI works from a maintained host allowlist of known AI vendors — it inspects traffic to those hosts and leaves everything else untouched. This bounds what’s inspected (and what it costs), but it means a vendor we don’t yet recognize passes through without a verdict. The current allowlist covers:

• ChatGPT / OpenAI
• Claude / Anthropic
• Google Gemini
• Perplexity
• Mistral
• Cohere
• Microsoft Copilot
• GitHub Copilot
• Cursor
• DeepSeek
• Grok (x.ai)
• Poe
• HuggingChat
• Meta AI

​

Requesting a vendor

Adding a vendor to the allowlist is a small config change on our side — not a new build for you to deploy. To request one, email support@promptguard.co with the vendor and the hostnames its app or API uses.

​

Platform availability

All three platforms are downloadable today from promptguard.co/download:

​

Next steps