Threat model
Pre-release. Written for the security reviewer who has to sign off.
An agent behind Dyeline never sends a confidential passage outside your company, even if an attacker writes every word the model outputs.
Our attack suite tests it with an agent that always obeys the injection: 13 attacks leaked 13 times without Dyeline, and once with it. We’ll publish it, and run it on AgentDojo with real models.
The threat model
The guarantee trusts the library inside your agent, the labels it assigns as data enters, and your policy. So it also trusts that each wrapped tool names its connection truthfully. Everything else may be the attacker’s, including every word the model writes.
In scope
- Data from tools you wrapLabelled as it enters the agent’s context, with its connection’s sensitivity and trust, and fingerprinted so a passage is found in a later send.
- Connections your policy doesn’t nameTreated as confidential and untrusted, and read-only: the default fails closed.
- Sends outside the companyEmails, posts, web requests and other writes made through wrapped tools. A confidential passage is blocked. After untrusted content, a person approves.
- A model the attacker controlsThe guarantee holds even then. It doesn’t depend on detecting the attack, and no model decides.
Out of scope
- Agents that don’t run the libraryMost agents you buy, unless their vendor adds it.
- Reworded dataA paraphrase has no passage to match. Only the stricter rule, or an approval, stops it.
- Destinations your policy allowsA send inside the company goes through, even if an injection chose to send it.
- Prompt injection itselfWe don’t claim to stop it. An injection can still change what the agent says or decides within your policy. It can’t move data past the policy.
No detector catches every attack.
Most guardrails classify text as safe or malicious. A detector that catches 99% of attacks still lets one in a hundred through, and attackers can keep trying. EchoLeak got past Microsoft’s injection classifier by phrasing its instructions as a note to a person. In 2025, researchers from OpenAI, Anthropic, Google DeepMind and ETH Zürich bypassed 12 recent defenses (opens in a new tab) with adaptive attacks. Most fell more than 90% of the time, though most had reported near-zero attack success.
Per-tool permissions judge each call alone. A leak can be made entirely of permitted calls.
“Deterministic (non-LLM) safeguards that constrain the actions of the system.”
Built on published research.
Several of the papers below measure what security costs. CaMeL completed 77% of AgentDojo tasks with provable security, against 84% for an undefended agent. We’ll report attack success and task completion on AgentDojo and AgentDyn, including where we lose. We’re not affiliated with these authors.