Three-Phase Defense Model OGL-Mini Protects AI Agents from Prompt Injection and Modern LLM Threats

The article presents OGL-Mini, an open-source hybrid security model designed to defend AI agents, chatbots, and RAG systems against contemporary threats including prompt injection, system prompt leakage, and agentic attacks. It details real-world incidents from 2025-2026 involving Microsoft Copilot Studio, OpenAI Atlas, and Claude Code, showing how attackers bypass safety filters using structured formats and obfuscation. OGL-Mini employs a three-stage pipeline of heuristics, TF-IDF mini-classifier, and PII detection to intercept malicious inputs before they reach the LLM. The model was trained on over 110,000 examples covering OWASP LLM01 categories, agentic misuse, and modern obfuscation techniques. Available in TypeScript, Python, and Go, it runs efficiently on standard CPUs with low latency. The solution aims to address gaps in built-in LLM safeguards that remain vulnerable to techniques like Policy Puppetry.

HabrAugust 30, 2026Translated from Russian

Read at source

Development of applications based on large language models continues to accelerate, with AI agents, chatbots, RAG systems, and autonomous assistants becoming integral across industries. Alongside these capabilities comes a serious security challenge confirmed by current data: as of 2026, prompt injections retain the top position in OWASP Top 10 for LLM applications, while new attack types such as system prompt leakage, vector database vulnerabilities, and embedding weaknesses have been added.

Threat Landscape for AI Agents

Modern LLMs and agents built on them remain vulnerable to a wide range of attacks. Key categories from OWASP LLM Top 10 include LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM07 System Prompt Leakage, LLM08 Vector & Embedding Weaknesses, and LLM10 Unbounded Consumption.

Real-World Attack Examples

In December 2025, researchers at Tenable demonstrated a successful attack on an AI agent built with Microsoft Copilot Studio. The agent, configured for tourist bookings with access to customer records including credit card numbers, was bypassed through prompt injection, allowing disclosure of payment data and free bookings.

In October 2025, NeuralTrust researchers found a vulnerability in OpenAI Atlas where URL-masked natural language instructions tricked the agent into executing destructive commands such as deleting files from Google Drive.

Zscaler ThreatLabz uncovered a payment scam campaign using poisoned Python documentation that contained hidden instructions forcing AI agents to initiate fraudulent Stripe payments.

In April 2025, HiddenLayer disclosed Policy Puppetry, a universal jailbreak affecting GPT-4, Claude, Gemini, and LLaMA by embedding malicious instructions inside XML, JSON, and INI structures.

Checkmarx researchers demonstrated the Lies-in-the-Loop attack on Claude Code from Anthropic, achieving remote code execution by deceiving the agent during user confirmation steps.

OGL-Mini Architecture

OGL-Mini (Open Guard Layer) implements three-stage protection: heuristics for rapid pattern matching, a TF-IDF mini-classifier distilled from DeBERTa-v3-xsmall trained on 110,734 examples, and PII detection. The pipeline adds only 10–300 ms latency on standard CPUs and supports TypeScript, Python, and Go modules.

The model is available at the open-source repository and can be integrated immediately to filter inputs and outputs for AI agents.

Claude Code Microsoft Copilot Studio OpenAI Atlas Policy Puppetry OGL-Mini DeBERTa-v3-xsmall NeuralTrust

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI Security

AI Security

Logical Argument Claims Full Alignment of Superintelligent AGI Is Fundamentally Impossible

A detailed analysis argues that the AI alignment problem cannot be solved for systems exceeding human cognitive capabilities. The paper presents a formal proof showing that any control mechanism created by humans will inevitably be circumvented by a more intelligent agent. It draws on foundational theorems from logic and cybernetics to support the conclusion that alignment is not an engineering challenge but a logical impossibility. Recent 2025-2026 research papers reach similar conclusions using computability theory and diagonal arguments. The work concludes that the only way to guarantee alignment is to avoid creating superintelligence altogether. All proposed restrictions are described as temporary delays rather than permanent solutions.

HabrOct 29, 2026Translated from Russian

AI Security

Claude Account Bans Linked to IP Reputation, Device Environment and Payment Channels, But No Confirmed Formula

Discussions on the Chinese forum NodeSeek have highlighted observations from a user who reported bans on more than twenty paid Claude accounts. The user identified IP address reputation, device environment traces, and payment processor history as the main factors potentially triggering blocks by Anthropic. However, the original post does not present a unified scoring system or prove specific penalties for using Linux, browser-only access, or the Fable model. High query volume is described mainly as a rate-limit issue rather than an automatic account ban trigger. Community members remain divided, with some confirming isolated observations while others label the conclusions speculative and share contradictory experiences. No universal method to avoid blocks has emerged from the discussion.

AntiMalwareOct 29, 2026Translated from Russian

AI Security

Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security

The article examines how local large language models can be integrated into application security workflows without relying on cloud subscriptions. It traces the evolution from llama.cpp in 2023 through agentic frameworks like PentAGI and Strix in 2025-2026. Teams can now run models on local hardware, connect them to code analyzers such as Semgrep, and delegate specific tasks like vulnerability path reconstruction or multi-step application testing. The piece highlights practical scenarios including static code review, dynamic testing with browser and terminal agents, and security evaluation of embedded AI assistants using tools like Garak and PyRIT. It stresses the importance of task decomposition, context management, and verification of model outputs to avoid misleading results. Hardware performance, model selection, and custom agent configurations are presented as key factors for successful adoption.

HabrOct 29, 2026Translated from Russian