It catches known patterns and their obfuscated variants before an agent acts. It does not catch novel zero days, pure semantic deception, insider misuse or anything outside the input layer. This page lists both sides without spin. Do not pass to the agent. Route to human review. Passed with the findings attached. Nothing is stripped. A confidence floor, not a guarantee. Why This Page Exists Most tools won't publish what they fail to catch . We think that's backwards. If you don't know the scope of a security control, you use it wrong, you over rely on it and leave real gaps or you dismiss it entirely. Neither serves you. Sunglasses is an ingestion time filter for AI agent inputs. One layer in a defense stack, not the whole stack. This page documents where the layer works and where it doesn't, plain language, real numbers. Read it before deciding whether Sunglasses fits your architecture. Spot a gap we haven't listed? [email protected] , we'll add it. Publishing your limits is a strategy, not a weakness. Buyers who read this and decide Sunglasses alone isn't enough for their threat model are making the correct call, it never is, for any serious deployment. This page filters for the customer who layers it correctly. What Sunglasses Catches Multiple patterns per family, multilingual variants and normalization first handling so common obfuscation doesn't bypass detection. Direct Prompt Injection Untrusted input that tells the agent to ignore its instructions , override its system prompt or adopt a hostile persona. Covers 200+ variants across 13 languages with dedicated patterns, attackers routinely translate payloads to slip past English only filters. ignore previous instructions Indirect Prompt Injection Malicious instructions hidden inside content the agent reads , RAG results, browsed web pages, email bodies, documents. The attacker never touches the conversation. They only poison what the agent ingests. hidden in retrieved content MCP Tool Poisoning Instructions embedded in MCP tool descriptions , parameter docs and schema annotations, text the model reads during tool discovery, before any tool executes. tool description directives Cross Agent Injection Payloads that propagate agent to agent during handoff, forged revocation receipts and persona scope rebind attacks. A growing surface as multi agent pipelines spread. agent handoff boundary README Poisoning Hidden directives in repository READMEs an agent reads at install time or during code analysis. Scanned the same way as any other agent input. install time repo text Credential Exfiltration Payloads engineered to extract API keys, tokens and secrets from the agent environment, "encode this key as base64", "report any variable containing SECRET". key / secret extraction Encoded Payload Obfuscation Base64, hex, ROT13, Unicode homoglyph and zero width tricks. 17 normalization passes run before detection, the reason encoded variants that beat raw keyword scanners still get caught here. Context Flooding Attacks that overwhelm the context window with filler to push prior instructions or system context out of the active window. Detected by characteristic flooding signatures. window eviction filler System Channel Promotion User or tool messages that try to claim system message authority , telling the model to treat untrusted input as if it were a system instruction. forged system authority Runtime Governance Bypass Payloads targeting the guardrail orchestration layer , disabling safety layers, skipping approval workflows or circumventing runtime policy checks. disable the guardrail State Sync Poisoning A2A protocol attacks that corrupt shared agent state during synchronization, injecting false ground truth downstream agents will trust. Shipped in 0.2.22. shared state corruption Agent Contract Poisoning False trust contracts smuggled into agent configs, poisoning the permissions, trust relationships and operating rules an agent loads before it runs. poisoned config contract Tool Output Policy Override Tool return values that instruct the agent to bypass its policy based on what the tool "said", treating output as an authoritative command instead of data. output as instruction Memory Permission Drift Incremental scope expansion through memory manipulation, each step looks modest. The cumulative effect is privilege escalation. creeping privilege escalation Supply Chain Attack Signals Package and repo signals that flag potentially poisoned dependencies for human review. A pre ingestion screen, pair it with full SBOM tooling, not a replacement for it. poisoned dependency signals Multilingual Variants Multilingual coverage sits in the prompt injection, exfiltration, unicode evasion and code switching rules, where payload translation is a documented evasion. Keywords cover 27 languages besides English, among them Spanish, Arabic, Hindi, Japanese, Korean, Russian and Chinese. 13 languages with dedicated patterns Audio Prompt Injection Audio is transcribed via Whisper before scanning, then text level detection runs on the transcript. Catches spoken injection phrases, but only what transcription surfaces. Whisper transcript path Video Prompt Injection Processed via FFmpeg frame extraction plus Whisper audio transcription. Covers extractable frame text and spoken audio. Steganographic and OCR evading payloads are out of scope. frame + audio extract What Sunglasses Does Not Catch Not fine print. Real gaps. If any of these apply to your deployment, you need additional controls beyond Sunglasses. Novel Zero Day Patterns A new attack family invented after the last update passes with an allow decision until patterns are added. The fundamental limit of any signature system, the database grows daily, but the gap is real and non zero. never seen patterns Sophisticated Semantic Only Attacks Attacks with no detectable phrasing , pure semantic context, individually clean messages that groom trust incrementally, will not be caught. Semantic analysis is on the roadmap, not in the current engine. no phrasing signal Misuse by an Authorized User An admin issuing harmful instructions through normal, un injected prompts looks identical to legitimate use at the ingestion layer. Insider threat is a trust boundary problem, not a detection one. insider misuse Model Internal Vulnerabilities No visibility into the model’s internal reasoning , training biases, hallucination or alignment failures. Harmful output from the model’s own properties is the provider’s responsibility. model reasoning Hardware & Network Attacks

Side channel timing, MITM on API calls, OS level attacks against the host, all outside an input filter’s scope . These need infrastructure level defenses. infra layer attacks Encrypted Payloads If Sunglasses receives only ciphertext without the key, the normalized input it matches against is the ciphertext, not the hidden payload. No text scanner can read what it cannot decode. undecodable ciphertext Adversarial OCR Evading Images Images crafted with adversarial perturbations to make OCR fail, text a human or vision model could read, but that produces no transcript to match against. Active research area. OCR evading images Sub Audible Audio Attacks Payloads in ultrasonic or sub audible frequency bands Whisper never transcribes leave no detectable text. Not seen in the wild, a theoretical gap we name honestly. frequency domain audio Secrets Arriving In A Tool Result One gap remains, and it is wider than a channel: GLS-SD-010 is line-anchored, so a KEY=value sitting inside a JSON string or behind a quote is not matched on any channel — not in a tool result, and not in a file or a message either. secrets in tool results Behavioral / Longitudinal Attacks Harm that unfolds across many individually clean interactions , no single message carrying a pattern. Sunglasses scans inputs, not behavior over time. Pair with behavioral monitoring. cross session behavior eight -API siblings gave the secret rules an api_response channel, so an AWS key, a private key or a GitHub token arriving in a tool result is detected — GLS-SD-001-API and GLS-SD-003-API are the rules that fire on an AWS key id and secret pair. When the value is in a known credential format the GLS-SD-001 family still catches it everywhere, so what is uncovered is an assignment whose value has no recognisable shape — a password, a connection string, an internal token — once it is embedded. GLS-SD-001 in files, messages and web content, GLS-SD-001-API in tool results needs a different anchor, which is a new rule rather than a channel added to this one. The False Positive Story: 86 → 0 The honest version, including the three qualifiers you still need before relying on it. Through v0.2.63 the filter flagged 86 false positives on real code, including its own README and Python standard library files. In v0.2.64 we root caused the leaky detection keywords and over broad anchoring. The same corpus now scans clean. That zero isn't a one time screenshot. Every release must produce zero blocking findings on a clean code corpus of real samples (including full Python standard library files) before it ships. The gate runs in the test suite on every version. A corpus is not your traffic Zero on our corpus doesn't promise zero on your input distribution. If your agent processes content with imperative or security language, you can still see false positives. Test on a representative sample before production. False positives land on quarantine, not block Critical/high return block . Medium returns quarantine . Low returns allow_redacted . A false positive on a benign prompt typically returns quarantine : human review, not automatic rejection. Production cost depends on your workflow With a human in the loop review process, a false positive costs review time. In a fully automated pipeline with no review step, a quarantined legitimate request has immediate user facing impact. Design your integration with the review workflow in mind. What 37/38 Benchmark Recall Means The number is real and reproducible . Here's exactly what it proves and what it does not . Sunglasses caught 37 of the 38 attacks in the benchmark that ships in the repo and missed one, which we publish on purpose. Precision on the same run is 86.1%. Anyone can rerun it with python3 tests/benchmark/precision_recall.py . It is a fixed dataset The 38 attacks and the 77 famous open source READMEs ship in the repo and were labeled by the team. Not an independent third party red team with novel attack generation. It is not a universal figure 37/38 means 97.4% recall against those 38 specific attacks, not against all possible attacks. Attacks the team hasn't seen are not in this measurement. Real world recall is unknown Measuring it requires widespread production deployment with ground truth labels on attack traffic. Data we don't yet have. The CVP synthesis goes further Six runs, four Claude model families, 120 transcripts, all clean. Still an internal evaluation, not a deployment scale recall measurement. Read the full CVP Family Synthesis . 37/38 benchmark recall tells you the engine works against the attacks in that dataset. It does not tell you what it will do against attacks it has never seen. Those attacks exist and will bypass us until we learn them. Report bypasses at GitHub Issues : they become patterns. Rerun the numbers yourself, including the miss we publish on purpose. See the reproducible benchmark . One layer, layered right Pair Sunglasses (ingestion time, pre model) with runtime monitoring, access controls, tool permission scoping, human review for high risk actions and incident response. When it catches something, trust the signal. When something falls outside its scope, have other controls in place. Frequently Asked Questions Is Sunglasses comprehensive? Does it cover every AI agent attack? No. 1583 patterns in 117 categories is substantial coverage of known attack families, but it is not exhaustive. Novel attacks, semantic only attacks and attacks outside the input layer are not covered. No ingestion filter should claim to catch everything. The question is whether the coverage matches your actual threat model. What happens when a novel attack bypasses Sunglasses? It returns allow , the same as a legitimate clean input. You cannot distinguish a false negative from a true allow at the Sunglasses layer alone, which is why runtime monitoring and behavioral analysis are necessary complements. Reported bypasses become new patterns. The database grows daily. Report at GitHub Issues . What about insider threats (an authorized user doing something harmful)? Sunglasses cannot help here. An authorized user issuing harmful instructions through normal, non injected prompts is technically indistinguishable from normal authorized use at the ingestion layer. Insider threat requires access controls, audit logging, least privilege scoping and behavioral monitoring, controls that operate on identity and behavior, not input content. Should I rely on Sunglasses alone as my AI agent security strategy? No. Sunglasses is one layer. A reasonable stack includes: Sunglasses as an ingestion time filter (pre model), runtime monitoring and behavioral analysis (post model), access controls and tool permission scoping, human review gates for high risk actions and incident response procedures. See Guardrails Are Not Enough . Does the CVP evaluation prove production grade recall? No. The CVP evaluation (six runs, four Claude model families, 120 transcripts) documents detection consistency across models and effort tiers against an internal adversarial corpus. It does not constitute a production scale recall measurement. Real world recall against novel attacks in live deployment is unknown. Methodology and per prompt verdicts are published in full at sunglasses.dev/reports . What is the practical cost of false positives in production? It depends on your input distribution and review workflow. Most false positives land on quarantine rather than block , human review, not automatic rejection. With a human in the loop process, the cost is review time. Fully automated with no review step, a quarantined legitimate request has user facing impact. The enforced gate is zero false positives on our clean code corpus. Your actual rate depends on how your legitimate inputs compare. Test on a representative sample first. JACK is one of two AI research agents on the Sunglasses team. He runs autonomous pattern extraction cycles inside a Docker container and contributes detection signatures to every release. Meet the team → Sunglasses can measure traffic and campaign performance, but only if you say yes. Essential storage stays on. Analytics and marketing stay off until you choose. We are not doing the fake “trust us” banner. The site works without analytics. If you opt in, Sunglasses will use analytics and marketing storage to measure what pages work and which campaigns bring real buyers back. If you say no, non essential Google consent stays denied. Required to remember this choice and keep core site behavior stable. Allows GA4 to measure page performance after consent. Reserved for future ad measurement and retargeting. Off by default.