ProvGuard
An open-source Python library that protects AI agents from prompt injection. It doesn't guess whether text is malicious; it checks which source supplied each sensitive argument.
AI agents read e-mails, web pages and documents written by strangers, then take real actions like sending money or e-mail. An attacker can hide an instruction in that text and steer the agent.
ProvGuard takes a different approach. It labels everything the agent sees as trusted or untrusted, and before a tool runs it checks where each argument (recipient, IBAN, amount) came from. An IBAN that only appears in an e-mail cannot move money, however the e-mail is worded.
The site has an in-browser playground where you can hijack an agent and watch ProvGuard decide. Results are measured on the AgentDojo benchmark from ETH Zürich.
- AgentDojo, model-free: banking 144/144 (100%), Slack 97/105 (92%), workspace 200/240 (83%), travel 79/120 (66%).
- Live agent: on Qwen3 8B, attack success fell from 16/48 to 0/48 with no measurable utility drop.
- Honest limits: what it can't catch is written up front in the README.