Policy Puppetry

Three-Phase Defense Model OGL-Mini Protects AI Agents from Prompt Injection and Modern LLM Threats

The article presents OGL-Mini, an open-source hybrid security model designed to defend AI agents, chatbots, and RAG systems against contemporary threats including prompt injection, system prompt leakage, and agentic attacks. It details real-world incidents from 2025-2026 involving Microsoft Copilot Studio, OpenAI Atlas, and Claude Code, showing how attackers bypass safety filters using structured formats and obfuscation. OGL-Mini employs a three-stage pipeline of heuristics, TF-IDF mini-classifier, and PII detection to intercept malicious inputs before they reach the LLM. The model was trained on over 110,000 examples covering OWASP LLM01 categories, agentic misuse, and modern obfuscation techniques. Available in TypeScript, Python, and Go, it runs efficiently on standard CPUs with low latency. The solution aims to address gaps in built-in LLM safeguards that remain vulnerable to techniques like Policy Puppetry.