Every major AI lab now treats prompt injection as unfixable — a permanent occupational hazard of agentic AI. AEGIS 1.0 is my counterargument, written in code.
AEGIS = Authenticated Execution Gateway for Injection Security.
Last December, OpenAI publicly stated that prompt injection “is unlikely to ever be fully solved,” comparing it to scams and social engineering. Anthropic has called it “far from solved” in its Opus 4.5 launch materials. Google echoes the framing in Gemini 3’s system card.
The industry has converged on a position: this is something to be managed, not fixed. Their reasoning isn’t wrong. An LLM ingests one token stream. It cannot reliably distinguish trusted system instructions from untrusted retrieved content. That’s architectural, and no amount of fine-tuning can close the gap — it’s a fundamental weakness of LLM systems.
But that conclusion only holds if you insist on solving the problem inside the model.
AEGIS is a model-agnostic sidecar gateway that solves it outside the model, with cryptographic provenance and capability authorization instead of natural-language filtering.
Five composed layers vote on every request before it reaches the LLM, and again on every tool call before it executes:
- CCPT — HMAC-signed envelopes binding origin and trust to every context chunk
- Trust Lattice — Bell–LaPadula info-flow rules; untrusted content cannot authorize tool calls
- Intent Anchor — semantic drift detection between the user’s stated intent and proposed actions
- Canary Tripwires — cryptographic honeytokens that flag leakage as it streams
- Capability Tokens — single-use, parameter-constrained, time-bounded auth the model cannot mint
Every decision is written to a hash-chained, append-only audit log you can verify end-to-end.
The thesis is simple: prompt injection is unsolvable as a content-classification problem. As a structural problem — origin, trust, capability — it has the same shape as problems systems security has been solving for forty years.
AEGIS sits in front of Claude, GPT, Gemini, and any MCP server. MIT licensed, with a verifiable build pipeline (cosign + SLSA + SBOM). It’s also my first open-source release.
Adversarial benchmark, balanced mode:
- 100% block rate on direct, memory-poisoning, and multi-agent attacks
- 87.5% on indirect injection
- 0 false positives on benign traffic
- ~0.1ms added p50 latency, >12k req/s
It’s available here. Very open to feedback, questions, issues, and contributions. Genuinely curious to hear where this thesis breaks — especially from those at the frontier labs who’ve thought hardest about why it can’t be done, and claim prompt injection as a permanent occupational hazard.
Scutum contra iniectionem.