The eagle that spots the threat. An open-source guard for AI agents that watches both directions — catching prompt-injection on the way in, and stopping private data from leaking on the way out. Defense built on what an action does, not on matching the attack string.
A poisoned GitHub issue hijacks your coding agent. An invisible instruction on a web page redirects your browsing agent. A crafted email makes your assistant exfiltrate data. Most defenses only watch what comes in. But there's a second threat nobody talks about: your agent holds private context — files, messages, family details, finances — and can leak it the moment it replies in a group chat or comments on an issue. No attacker required. Jataayu guards both directions.
Prompt & command injection, jailbreaks, social-engineering, homoglyphs and encoded payloads — flagged before your agent ever acts on the text.
PII, secrets, minors' info, health and financial details, protected names — detected and auto-redacted before the reply ever leaves.
A shell command is suspicious in a GitHub issue, expected in a coding task. Every surface gets its own trust level and strictness.
Reports what it found and why, with a risk score. MIT-licensed library, CLI and MCP gateway hook. 344 tests, reproducible benchmarks.
Real checks, rendered the way they read in the library: the content under inspection, the verdict, and the policy decision — for an attack coming in and a leak going out.
Matching attack text is the weakest tier — an adaptive attacker just rewrites the string. Jataayu keeps a fast regex layer as a cheap pre-filter, then moves the real boundary to action-level authorization, following the 2026 agent-security literature (CaMeL, FIDES, SecAlign). Four layers, defense-in-depth.
Multi-view normalization — NFKC, homoglyph fold, zero-width strip, de-space, de-leet — plus recursive base64/hex/url decode. An attacker must evade every view at once.
Deterministic PREVIEW→COMMIT. Provenance-typed values × effect severity × capability policy decide ALLOW / DENY / NEEDS-APPROVAL. No LLM in the loop.the security floor
SecAlign-style SFT+DPO tuning of a structured-query model that obeys the instruction channel and ignores instructions buried in data. Defense-in-depth, never the floor.
100+ patterns across injection, command-exec, social engineering, encoding. Sub-millisecond; escalates ambiguous cases to an LLM slow path.
Jataayu's design follows a clear consensus in the 2026 agent-security literature: you can't secure an agent by checking its final answer — you have to watch what it touches. Matching the attack string is the weakest tier; an adaptive attacker rewrites it. The durable defenses move the boundary onto the action and its effect. The papers below, grouped by the argument they make, are what Jataayu is built on.
Note: several of these are fresh 2026 preprints, mostly not yet peer-reviewed — presented here as threat reports on the agent stack, not as independent validation of Jataayu. Self-reported figures are attributed to their authors. Full per-paper gap → upgrade notes live in the repo (docs/upgrades-from-arxiv-2026-06.md).
These are attack-success rates with Jataayu in place — lower is better, and the green bar shows how much of the attack surface is closed. Every figure is from a reproducible benchmark — the public deepset/prompt-injections set for the fast path, a held-out structured-injection set (disjoint train/test payloads) for the learned tier, and the public InjecAgent suite (arXiv:2403.02691) for indirect injection through tool returns. The hard caveats are documented in the repo, not hidden.
Checking text in and text out is only the cheap outer layer — an adaptive attacker just rewrites the string. The real integration point is the effect boundary: wrap every tool call your agent is about to make, so Jataayu authorizes it by the surface it touches — shell, network, file, secrets — and the provenance of the values driving it. An injection that slips past the text checks still can't get a high-effect action committed.
from jataayu import jataayu_authorize_action, jataayu_check_outbound # THE BOUNDARY — authorize by what the action does, before any tool runs. # Same content; the verdict depends on the SURFACE the call touches. auth = jataayu_authorize_action( tool_name="bash", # effect: shell / code-exec params={"cmd": cmd_from_issue}, # value derived from an untrusted issue untrusted=True, ) if auth["decision"] == "deny": # untrusted → shell ⇒ DENIED raise SecurityError(auth["reason"]) if auth["decision"] == "needs_approval": # e.g. untrusted → network / file require_human(auth["commit_token"]) # token binds the exact request # OUTBOUND is still a real surface — strip private data before it leaves. res = jataayu_check_outbound(reply, surface="discord-channel") safe_text = res["redacted"] if res["status"] != "SAFE" else reply
Wrapping every tool call by hand is optional — the MCP gateway hook applies the same effect-boundary check to all tool calls automatically. Inbound text screening (jataayu_check_inbound) still runs as the cheap pre-filter on the way in.
The same content is graded by where the action takes effect. Low-trust surfaces get strict inbound checks; group surfaces get strict outbound privacy; private and agent-to-agent channels stay light.