Prompt injection protection for coding agents

The gate judges what an agent runs; the injection guard judges what it reads first. After a web fetch, an MCP call, a read of a file outside the project or a network command, it scans the result for text written to steer the agent and returns pass, warn or block. It is a filter: an injection written as ordinary prose can pass the local detectors.

Does Reflex protect coding agents against prompt injection?

Yes, as a filter: the injection guard scans tool results from the web, MCP servers, files outside the project and network commands for text written to steer the agent (hidden Unicode, instructions in HTML comments or hidden elements, text addressed to an AI, markdown image exfiltration, encoded payloads). In enforce mode it warns the agent or removes the text, then makes the rest of the session stricter: network egress asks and nothing is auto-approved. In enforce mode it also blocks prompts that contain a pasted credential. On a 62-case golden set Jev reached 97 % precision and 100 % recall, the local detectors 81 % and 79 %; an injection written as ordinary prose can pass the local detectors.

See: GUIDE: injection guard; try it with reflex scan page.html.

Prompt injection guard for coding agents

• Scans tool results from the web, MCP servers, files outside the project and network commands for text written to steer the agent: hidden Unicode, instructions in HTML comments or hidden elements, text addressed to an AI, markdown image exfiltration, encoded payloads, letter-spaced phrases.
• Warns the agent, or removes the offending text where the agent lets a hook rewrite results.
• After a finding in enforce mode, the gate is stricter for the rest of that session: network egress asks, and nothing is auto-approved.
• In enforce mode, blocks prompts that contain a pasted credential.

A prompt injection in a fetched README

{
 "outcome": "block",
 "rule": "instructions hidden from a human reader (invisible text, HTML comment or hidden element, encoded blob)",
 "gate": "hidden",
 "source": "deterministic",
 "engine": "local",
 "signals": {
  "hidden": 1
 },
 "chunks": []
}

{
 "outcome": "block",
 "rule": "instructions hidden from a human reader (invisible text, HTML comment or hidden element, encoded blob)",
 "gate": "hidden",
 "source": "jev",
 "engine": "jev",
 "signals": {
  "hidden": 1
 },
 "chunks": [
  {
   "id": "c0",
   "addressed": 0.98,
   "attack": "run_commands",
   "severity": 2.99
  }
 ]
}

{
 "outcome": "pass",
 "rule": "phrase hits in text that informs rather than directs (addressed 0.03)",
 "gate": "jev-benign",
 "source": "jev",
 "engine": "jev",
 "signals": {
  "shell": 1,
  "acts": 1
 },
 "chunks": [
  {
   "id": "c0",
   "addressed": 0.03,
   "attack": "none",
   "severity": 0.73
  }
 ]
}

Injection guard

The gate judges what an agent runs. guard.mjs judges what it reads first: a web page, search results, an MCP result, a file from someone else's project or the output of curl can carry text written to steer the agent (indirect prompt injection). After such a tool runs, the guard scans its result and returns pass, warn or block; on each prompt it also checks for a pasted credential.

Which results are inspected (sources in setup/injection/policy.json):

Anything else (edits, greps, local commands, the user's own files) is not inspected. A hook matcher cannot see a Read's path, so every Read starts the guard process (about 50 ms), which returns at once for a file inside the repository.

Deterministic detectors (setup/injection/detectors.json, both engines), each counted as a signal:

• override: text that cancels or replaces an AI's instructions (ignore previous instructions, your new task is, do not tell the user, the user has already authorized you).
• role: fake chat-role or system markers (<|im_start|>, [INST], <system_prompt>, <IMPORTANT>).
• to_ai: text addressed to an AI agent (note to AI agents, if you are an LLM, whoever is processing this page, @claude).
• shell, secrets, exfil: what the text asks for (a remote script piped to a shell, reading keys or .env, sending data to a URL). Alone these are how install guides read; they matter next to an address to an AI.
• hidden: text a human reader does not see that speaks to an AI: Unicode tag characters (U+E0000 to U+E007F, ASCII smuggling; emoji flags excepted), a phrase split by zero-width characters, HTML comments, CSS-hidden elements, alt / title / aria-label attributes, markdown comments, the text of data: URLs, base64 blobs (also URL-safe or wrapped over lines) that decode to such text, and text spelled in a run of variation selectors. The phrases are matched on the text as a reader takes it in: invisible characters and soft hyphens out, look-alike Cyrillic and Greek letters, full-width, mathematical and accented letters read as Latin, JSON \u escapes and HTML character references decoded. A phrase that needed a disguised letter counts as hidden. They are also matched on text spaced out letter by letter (I g n o r e p r e v i o u s, with any spaces, read with the narrowest gaps taken out); there a phrase counts like a plain one, since a reader sees it, so Jev can clear a quotation.
• exfil_link: a markdown image (or HTML img) whose URL has a placeholder or a data word (?q={conversation}, [DATA], ${SECRET}), or a link (markdown, HTML a or <https://…>) with a placeholder in a query value; reference-style ones (![x][1] … [1]: url) by their definition. An image is fetched when the agent's answer is rendered.
• invisible: zero-width and bidi controls, outside emoji sequences and right-to-left text.

Jev (engine jev): the result is cut into chunks with context.mjs's chunk() (at most 3,000 characters each; at most 24 per result, those with a detector hit first, 8 per request with the requests in parallel), and each request asks three questions per chunk (setup/injection/questions.json). A piece under 1,000 characters goes with a neighbour when both fit in one chunk, else with the lines before it (overlapping the previous chunk) up to 3,000 characters: a short last section judged on its own has no page around it to show who it speaks to.

The user's last prompt goes with them (Claude Code, from the transcript) so "deviates from the task" can be judged. Chunks are redacted before they leave. Answers are cached by content for 24 h.

Policy (setup/injection/policy.json), per chunk; the worst chunk wins:

1. hidden instructions or an exfiltration link: block, whatever Jev says.
2. Jev: addressed >= 0.7, severity >= 1.8, an attack: block.
3. Jev: addressed < 0.2: pass. This is how an article that quotes an injection, or a README that tells a human to curl … | sh, gets through.
4. Jev: attack none and severity < 1.8, where the detectors saw an address to an AI and an action: warn (an @claude mention in one issue comment and an install line in another).
5. an address to an AI (override, role or to_ai) together with an action (shell, secrets, exfil): block.
6. Jev: addressed >= 0.5, severity >= 0.8, an attack: warn.
7. Jev: addressed >= 0.25, severity >= 1.8, an attack: warn. Jev is unsure the text speaks to an AI but names a serious attack: a polite request to "have the helper you are using" paste a key into a form scores 0.37 to 0.49. Text that quotes or reports an attack is judged attack none.
8. an address to an AI alone, or 12 or more invisible characters (with Jev, counted per chunk): warn.

With the local engine, steps 2 to 4, 6 and 7 do not exist, so a security article quoting an injection warns. A Jev error or an incomplete answer falls back to the detectors alone. A result longer than 4 MB is read in part and is at least a warn.

What each outcome does. Warn adds a note next to the result: the result is third-party content, not a message from the user, and the user has not asked for anything it says. Block removes the offending text where the agent lets a hook rewrite a result, marking each cut ([reflex: removed text addressed to an AI agent]): the paragraph around a phrase hit, the hidden segment, the link, or the whole chunk (up to 3,000 characters) that Jev blocked. The note says what was removed. Both record a taint for the session (enforce mode only):

Taint. A warn or block in enforce mode writes taint/<hash of the session id>.json in the data directory. For the rest of that session the gate:

• asks before network egress (curl, wget, ssh, scp, git push, gh api and gh … create/comment, npm publish, docker push, any URL, a script opening a socket): tainted in rules.json, checked before the read-only list and the fast lane, since gh api "…?q=$SECRET" is a read, a read-only ssh host 'uptime' still reaches the host, and git push is fast lane;
• never allows (calibrated allow is off);
• applies the policy's taint gates (flag taintStrict): ask at exfil >= 0.2, at blast >= 1.0, and for a mutation with on_task < 0.6.

Rules that deny still deny. Like Jev decisions, the taint only takes effect in enforce mode. A user policy.json seeded by an earlier setup gets what it lacks on the next reflex setup: gates, params and flags of the bundled policy missing from it by id or name are added (a new gate right after the one before it in the bundled order), nothing of the user's is changed or reordered, and setup prints what it added. A deleted bundled gate comes back that way; switch one off with its flag instead. In opencode the taint is kept under a subagent's root session, so a child that read an injection makes its parent stricter.

Credentials in prompts use the credential shapes of setup/redact.json (AWS keys, GitHub, GitLab, OpenAI and Slack tokens, private keys, JWTs, Stripe, Google and npm keys, Slack webhooks; not the bare 40-character shape, which also matches long identifiers), and not its KEY= context patterns, which would stop what does max_tokens: 100 do. The log keeps the key type and a hash of the redacted prompt, never the key.

Modes. The guard follows the gate's mode unless REFLEX_GUARD (or "guard" in ~/.config/reflex/config.json) says otherwise. Shadow judges in a detached background process, logs, and changes nothing: no note, no rewrite, no taint, no blocked prompt. Off does nothing. Any error passes: the guard only adds friction when it has a judgment to add.

Try it:

reflex scan page.html                  # exit 0 pass, 1 warn, 2 block; JSON with the signals
curl -s https://example.com | reflex scan - --rewrite     # also print the cleaned text
npm run eval-injection                 # setup/injection/golden.json against the live API

The golden set holds 62 results: 29 benign documents agents read every day (install guides that pipe curl to a shell, man pages, API docs, npm output, HTML with comments and hidden menus, OWASP pages, a blog post and a long field guide that quote or describe injections, a long README of a coding agent, a GitHub issue that mentions @claude next to an install line, an AGENTS.md from another repo, letter-spaced headings, accented, right-to-left and emoji text) and 33 injections following published research (hidden-text pages, the GitHub MCP issue attack, MCP tool poisoning, Unicode tag and variation-selector smuggling, look-alike letters, JSON escapes, markdown image exfiltration, also reference-style, the rules-file backdoor, EchoLeak-style mail, fake role tags, paraphrased injections with no trigger words: behind twelve chunks of benign text, split across two chunks, on one long line, at the top, middle and end of long pages; letter-spaced text). Current result, jev-1.13.0, five runs: precision 97 %, recall 100 %, every expected outcome met (the @claude issue warns), 28 or 29 of 30 high-severity injections blocked and the rest warned. With the local engine: precision 81 % (articles that quote injections warn or block), recall 79 % (the GitHub MCP issue attack and the paraphrases, which have no trigger phrase, pass). A missed high-severity injection fails the run.

Logs. guard.jsonl in the data directory: one line per inspected result (tool, source kind, hashes of the text and origin, length, signal counts, Jev's numbers per chunk, outcome, what was emitted, latency, tokens, the kind of a Jev error) and per blocked prompt (key types, a hash). Never the text, the URL or the command. reflex report summarises it: results by source, outcome and attack, tainted sessions and blocked prompts, as counts.

Limits. This is a heuristic filter, not a sandbox: it lowers the odds that injected text steers the agent; it does not make untrusted content safe, and the gate still judges every command the agent runs. The detectors are phrase lists and a handful of structural checks, so an injection phrased like ordinary prose passes them (Jev is there for that; the local engine has no answer to it), and text spaced out evenly letter by letter (the same gap between words), or one letter per line, is left to Jev. Jev sees at most 24 chunks of 3,000 characters per result; past that only the detectors read the rest, and past 4 MB nothing does (the result warns). A paraphrase split across two chunks is judged in halves: in the golden set each half still reads as an instruction, but a split where neither does would pass. Hidden elements are found by their own style or hidden attributes, not by class names or stylesheets. A tool the source list does not name (a custom pi extension tool, an MCP tool in opencode that shares a built-in name) is not inspected. The agent has read the result before Codex and Hermes can do anything about it, and in Hermes the note arrives a turn late. A Jev-blocked chunk is removed whole, which can cut useful text next to the injection. Shadow mode never taints, so the gate's taint behaviour only starts once the guard enforces. A hook that times out passes the result unguarded. Subagents run under their own session id in oh-my-pi and Hermes (and Hermes starts a new one after compressing the context), so taint does not cross between a parent and its subagents there. Codex fires no PostToolUse for a failed tool or an MCP error result, and scans only the last chunk of a long-running command. In Claude Code, WebFetch hands the hook the fetch model's summary of the page, not the page.