AI-adversary defense
Defence against prompt injection, agent hijacking and poisoned models. Not built yet.
- Available
- 00
- Limited
- 00
- Not released
- 00
- Coming
- 03
How the attack works
AI agents are being given tools — email, files, browsers, code execution, company systems. Anything the agent reads can contain instructions, and a model cannot reliably tell the user's instructions from text it was asked to process. That turns every document, web page and tool result into a possible command channel.
- STAGE 01
Injection
Instructions are planted in a web page, email, document, ticket or tool response the agent will read.
- STAGE 02
Hijack
The agent follows them: it calls a tool, changes a setting, or fetches data nobody asked for.
- STAGE 03
Exfiltration
Secrets or private data are sent out through a link, an image request, an email or another tool.
- STAGE 04
Supply chain
A malicious connector or plug-in is installed with broad scopes, or training data is poisoned.
- Teams connecting AI assistants to mail, drives and ticketing
- Developers running coding agents with shell access
- Organisations installing third-party AI connectors
A common pattern: an assistant asked to summarise an inbox reads an email containing hidden text that tells it to search for password-reset messages and include their links in a reply. The user only asked for a summary.
AI agents are being given tools and data access. Attackers hide instructions in documents and web pages to make those agents leak data or take actions nobody asked for.
Sensor, rule, evidence, action
Each step carries its own state. A step that is not built is shown as coming, not skipped.
Agent, tool and connector inventory
Which AI agents run in your organisation and what they can reach.
ComingEnterprise XDRInjection and tool-abuse detection
Direct and indirect injection, unexpected tool calls.
ComingAction audit trail
What an agent did, with which data, under whose instruction.
ComingPolicy, not a model verdict
The product does not run local ML (ADR D-23) and does not describe rule-based checks as AI.
Coming
We are stating this plainly: no AI-security detection runs in any Safeavio product today. All seven related attack families in our register are marked unavailable.
The planned module will inventory AI agents, their tools and connectors, and audit the actions they take.
We do not run machine-learning models on your device today, and we do not describe rule-based checks as AI.
What works today, and what is coming
What works today
00In production or in the current download.
Nothing in this group yet.
Built, not yet released
00The code exists and is tested in the repository; it has not shipped to users.
Nothing in this group yet.
Coming
03Not built yet. Nothing on this list runs today.
- Agent, tool and connector inventoryComing
Which AI agents run in your organisation and what they can reach.
Enterprise XDR
- Prompt-injection and tool-abuse detectionComing
Direct and indirect injection, unexpected tool calls.
Enterprise XDR
- Data-exfiltration and action audit for agentsComing
An audit trail of what an agent did and with what data.
Enterprise XDR
7 attack families map to this capability
Copied row by row from our engineering register. A family counts as detected only when a rule, a sensor that feeds it and a test that makes it fire all exist.
Feature states above and register statuses measure different things: a feature can be built while the family it addresses stays unobserved, because the register counts sensors and rules, not screens.
| # | Attack family | Status | What the register says |
|---|---|---|---|
| 105 | Adversarial ML Evasion | No sensor | No ML detector exists to evade; no evasion benchmarkNothing runs |
| 106 | Model / Data Poisoning | No sensor | No training pipeline or data provenance checksNothing runs |
| 107 | Prompt Injection | No sensor | No AI agent surface instrumentedNothing runs |
| 108 | Indirect Prompt Injection | No sensor | No AI agent surface instrumentedNothing runs |
| 109 | AI Tool / Agent Hijacking | No sensor | No tool-call telemetryNothing runs |
| 110 | AI Secrets Exfiltration | No sensor | No secret-egress telemetryNothing runs |
| 111 | Malicious AI Connector / MCP-like Tool | No sensor | No connector identity/scope telemetryNothing runs |
What runs where, and what never leaves
Classification happens on the device before anything is queued. Cloud reporting is off by default on consumer devices and turning it off also stops events already queued.
Runs on the device
- Nothing today
May reach the cloud
- Nothing today
Never leaves
- Prompts and agent conversations are not collected today
Editions that include it
Each feature above names the platform or edition it runs on. An edition's own page lists the full state of that edition.
What to do if…
Practical steps that work whether or not you use our products.
You are connecting an AI agent to company systems
- 1.Give it the narrowest scopes that work; read-only where possible.
- 2.Require a human to approve actions that send, pay, delete or change permissions.
- 3.Keep secrets out of the agent's context; use short-lived, scoped tokens.
You install an AI connector or plug-in
- 1.Treat it like any third-party software: check the publisher, the scopes and what data leaves.
- 2.Review installed connectors regularly and remove unused ones.
An agent did something nobody asked for
- 1.Revoke its tokens first, then investigate.
- 2.Find the content it read just before the action — that is usually where the instruction was.
Limits and known gaps
- GAP-01Nothing in this capability is built. All seven AI-related families in the register (#105–#111) are not observable.
- GAP-02There is no ML model in the product to evade or poison, and none is planned for local use.
Frequently asked
Does Sentinel use AI to detect threats?
When will AI-agent protection be available?
Capabilities that work alongside it
Password exposure checks, account sign-in safety and hacked-account help today; verified-address monitoring interfaces need a configured provider for results.
A file check and guidance only. No detection engine runs, so Sentinel never says whether media is real or fake.
Checks a link before you open it and warns about lookalike domains.