AI Cordon

Find prompt injections in the text your model reads: mail, pages, tool results, retrieved chunks.

Two detectors with the same Python API and CLI.

Picket: bulk scanning, ingest pipelines, mail gateways, offline use. Intent: where a missed injection is expensive. They can be combined: Picket on everything, Intent on what matters.

Quick start

$ pip install aicordon
$ aicordon picket scan letter.txt          # local, works right away
$ aicordon login                           # once: stores the Intent API key
$ aicordon intent scan letter.txt

from aicordon import picket, intent

fast = picket.load()
full = intent.load()          # key: api_key=..., AICORDON_API_KEY, or `aicordon login`

for det in (fast, full):
    rep = det.check(text)
    if rep.flagged:
        for f in rep.findings:
            print(det.title, f.threat, text[f.span[0]:f.span[1]])

A report lists findings with their positions. No findings does not mean no injection.

Both on the same five texts

python examples/compare.py runs both over examples/texts:

text                         Picket (local rule)              Intent (API)
01-obvious-email.txt         alarm  IPI/Secret.Reveal.C       alarm  score 0.98
02-support-ticket.txt        —                                alarm  score 0.98
03-release-notes.html        —                                alarm  score 0.99
04-warning-question.txt      —                                —      score 0.40
05-quarterly-report.txt      —                                —      score 0.11

Both flag 01. Texts 02 and 03 contain no known phrasing, so only Intent flags them. Text 04 is an ordinary question that contains "ignore" and "previous instructions"; neither detector flags it.

Licensing

Apache License 2.0 (LICENSE), including the Picket rule base. Contributions are accepted under the DCO: sign off your commits with git commit -s.

Get an Intent key at ai-cordon.com.