Quilzo secures AI agents by enforcing their limits outside the model. Even an agent whose model has been fully hijacked by prompt injection can only do what its declaration allowed, actions that matter wait for a person, and private data cannot leave without one.
The threat: agents do what they read
Prompt injection is the top risk in OWASP's Top 10 for LLM applications. An attacker does not need access to your systems; they only need your agent to read something they wrote: a web page, an email, a document, a calendar invite, a tool's output. Indirect prompt injection hides instructions there, and the agent carries them out with your credentials.
Filters and better system prompts reduce this, but they are guesses about text. Quilzo assumes the guess will sometimes be wrong and makes sure a wrong guess cannot do much.
How Quilzo defends agents
Limits the model cannot change
Every agent has a declaration of what it may read, call and change, enforced by one gate on every action. The model picks from that list; it can never add a tool, widen its reach or raise its budget.
A person decides what matters
Capabilities listed under ask-first stop the run. A person sees the exact call the agent wants to make and what it had read, and approving runs exactly that call and nothing else.
The exfiltration breaker
Quilzo tracks what each run has read. A run holding something private, such as a draft, a recalled memory or personal data a tool returned, that has also read somebody else's words cannot call out without a person. This stops the attacks that only change the arguments of a call the agent was allowed to make.
Memory that cannot be poisoned quietly
Anything an agent learns after reading untrusted text is held until a person confirms it, so one planted instruction cannot steer every later run.
Sandboxed programs
An agent's own code runs confined: user, process, network and mount namespaces, Landlock and seccomp, reaching Quilzo, a model and its declared hosts only through what is handed in.
Pinned tools
Agents call only the tools a person approved, and only while each tool's definition is still the one that was approved. A tool server that redefines a tool is refused.
Clean inputs
Invisible characters used to hide instructions are removed before any model reads text, and passages that address the AI rather than the reader are screened out of what chatbots read.
Measured against AgentDojo
Against the AgentDojo benchmark, assuming the attack has already won completely, with the model emitting the attacker's calls word for word, and asking only Quilzo's gate:
| Outcome | Result |
|---|---|
| Attacks refused | 26 of 26 |
| Tasks completed without a person | 71 of 97 |
| Tasks needing a person | 26 of 97 |
| Tasks refused outright | 0 of 97 |
An attack the gate refuses cannot succeed for any model, so the first line is a lower bound rather than an estimate. The scoring script runs in seconds with no API key: see the method.
Security around the agents
- A model gateway that masks emails, phone numbers, IBANs and national identity numbers before a prompt leaves, and never sends cards or credentials.
- A signed, hash-chained audit log, whose writer can run as an account of its own that nothing else can impersonate.
- A shield of playbooks that act the moment Quilzo itself is attacked and end on their own.
- Passkeys, single sign-on, short-lived credentials for CI jobs, and keys bound to the program that holds them.