Hidden text in an email can make an AI agent leak data
An LLM firewall against prompt injection, jailbreaks and data exfiltration.
Can you get an attack past the firewall?
A gullible assistant summarises three emails. One has hidden text. Turn Bulwark on and off, then write your own attack.
A small browser version with a deterministic fake model — no API key, nothing leaves your device. The real project is in the repo.
What it solves
An assistant that reads your inbox also reads text you cannot see: white-on-white lines in a newsletter that tell it to leak your other emails. Some models simply obey.
How it works
- Input layer: hidden text is stripped and injected instructions are quarantined before the model sees them.
- Output layer: links and images that would carry private data out are removed or rewritten; leaked system prompts and secrets are caught too.
- Tool layer: an agent may call only allow-listed tools; once untrusted content is in the conversation, risky actions such as sending email wait for a person's approval, and a recipient that appears only in that content is blocked.
The honest verdict
On 9 attack scenarios against an email agent, successful attacks fell from 2/9 to 0/9 on a small free model (one scenario failed in both modes on rate limits) and from 9/9 to 0/9 on a deliberately gullible one. A large free model, and Claude Haiku 5.5, Opus 5.5 and Qwen 3.7 Plus, resisted all 9 on their own, so on strong models Bulwark is defense in depth, not a dramatic before/after. Benign tasks: 8/9 with and without Bulwark on the large model; 3 needed one human approval, and the one failure with Bulwark was a false positive (a quoted attack phrase got part of a security newsletter quarantined). Detection alone is weaker than the headline: recall 0.85 at 5% false positives on the held-out split (40 attacks / 20 benign), 0.94 / 8.8% on the full set that the rules were tuned on, and 0.00 on BIPIA indirect injections. The numbers are measured, failures included.
Next demoPII Shield →