Skip to main content
When someone sends a message from Claude Desktop, ChatGPT Desktop or another AI app, the app doesn’t send only that message. Every request also carries:
  • the app’s own instructions;
  • the whole conversation so far;
  • a description of every tool its connectors offer.
The desktop agent passes all of it to PromptGuard. PromptGuard checks each part for what can actually go wrong in that part, instead of treating all of it as if the person had just typed it.

​
The four parts

​
Why not check everything as if the person typed it?

Because the app’s own text isn’t the person’s outbound message, and checking it that way makes the protection unusable:
  • The app’s instructions talk about instructions. A system prompt that says “these system instructions describe how the assistant behaves” looks like a prompt injection to a rule that flags the phrase. Checked as the person’s words, it blocked every request.
  • The person’s own profile isn’t a leak. Claude Desktop tells the model the signed-in person’s name. Redacting it rewrote the vendor’s system prompt on every turn, and protected nothing.
  • One false positive shouldn’t end a conversation. The app resends the whole conversation each time. If earlier turns were checked again for what blocks, a message that tripped a rule once would block every message after it.
What is checked is checked fully. A key pasted anywhere the person controls is caught: in the message itself, or in the project instructions and memory that travel inside the app’s instructions.

​
Where you see it

Every finding on a Shadow AI request carries a segment that says which part it came from: current_turn, earlier_turn, instructions or tool_definition. You’ll find it:
  • on the event in your dashboard;
  • in exported alerts;
  • on the Guard API response.
That lets your analysts tell a key someone typed apart from a key sitting in a project’s instructions, which need different fixes. Earlier turns appear in the response’s unscanned list with the reason earlier_turn, because they are checked only for what to redact. “Allowed” never claims more was read than actually was. A redaction in an earlier turn is reported with segment earlier_turn.

​
Agent versions

Tools the AI provider runs itself, such as Gemini’s Google Search or OpenAI’s web search, are offered by name only. There is nothing in them to check, so they’re not listed as unchecked. Everything else on this page applies to every agent version, because the checks run in PromptGuard, not on the device.

​
What is not inspected

Some traffic never reaches these checks at all. For example:
  • apps that pin their own certificates;
  • traffic over QUIC/HTTP-3;
  • messages an app sends over a WebSocket.
See Known limitations.