Your AI agent can be hijacked by the content it reads. We stop the damage.

Watch the same attack hit both agents

Two identical bank-support agents on the same model, one raw and one wrapped in Nemesis. The same prompts hit both. The raw agent emails data to an unknown address, fetches an attacker URL, and hits the cloud credential endpoint. The protected one, same prompts, blocks every one.

Why a classifier is not enough

An LLM reads system instructions, user input, and untrusted content as one stream and can't tell a command from data. There is no parameterized query for prompts. So filtering the text catches the textbook attacks and misses the novel and indirect ones, and in an agent a successful injection triggers real actions, not just bad words. The 2025-26 zero-click breaches (EchoLeak in Microsoft 365 Copilot, ForcedLeak in Salesforce Agentforce) each bypassed the vendor's own classifier and were fixed by an action or egress control. That control is the product.

What Nemesis catches that classifiers miss

Two layers, both in-process for an instant verdict: signature detection for the OWASP LLM Top 10, plus a learned behavioral baselinethat governs the agent's actions.

Is your LLM app vulnerable? Try these on it.

Run these against an app you own or are authorized to test. If any of them work, nothing is stopping a real attacker from doing the same through any content your agent reads. This is a self-audit, not a tool for other people's systems.

The prompts people paste to break a chatbot, blocked today

Paste any of these into your own assistant. On a raw model they leak the system prompt, dump keys, or hijack the reply. Every one is a real payload from our red-team suite, and the tag on the right is the exact detection Nemesis returns.

Or run the full scenarios, the way a real attacker would

const { allowed, result } = guardLLM(exchange, { mode: "enforce", agentBaseline });

// on the exfil attempt above, the SDK returns:
// { allowed: false,
//   result: { maxSeverity: "critical",
//     detections: [{ kind: "agent_new_egress", severity: "critical",
//                    signal: "new_egress:attacker.example", owasp: "LLM02" }] } }

if (!allowed) return refuse();   // the send_email never runs

Where teams use it

Get started in three steps

import { guardLLM } from "@nemesis-shield-autogon/sdk";

const { allowed, result } = guardLLM({
  agentId: "support-rag",
  prompt: userMessage,
  tools: toolCalls,           // tools the model wants to call
  toolArgs: toolCallArgs,     // their arguments
  context: retrievedDocs,     // untrusted RAG / tool output
}, { mode: "enforce", agentBaseline });

if (!allowed) return refuse();  // off-baseline exfil / tool abuse blocked

Manage it all from your editor with the Nemesis MCP server, and drop in the agent rules so your AI coding assistant keeps every new agent guarded.

Questions