Prompt injection detection tools: how they differ and where they stop

Direct and indirect injection

OWASP defines a direct injection as a user’s prompt changing the model’s behavior, on purpose or by accident, and an indirect injection as the model accepting input from outside sources, such as websites or files, that carries instructions. It adds that multimodal models raise the risk, because instructions can hide in an image next to harmless text. The full mitigation list is on our page for OWASP LLM01 prompt injection, and the glossary has entries for prompt injection and indirect prompt injection.

The split decides which tool fits. A detector that only sees what the user types will miss an instruction buried in a retrieved document. Ask each vendor which inputs the check sees: the user prompt, retrieved context, tool output, or all three.

Detectors belong to the runtime guardrails layer for live AI traffic in our AI Security Layers model. What an agent may do once an injection gets through is decided in the agent and tool access layer.

How detection approaches differ

This is our explanation of common approaches, not a claim about how any one product works. Each tool page links to the vendor page that describes its method.

• A classifier model, often called a safety classifier, labels each prompt as benign or an attack. It is fast and can be self-hosted, but it only knows the attacks it was trained on.
• Similarity search and pattern rules compare a prompt with a library of known attacks or phrases. They are easy to read and edit, and easy to evade with new wording.
• An LLM judge is a second model that reads the input and decides whether it contains an attack. It copes better with odd phrasing, costs more per request and can itself be targeted.
• Canary tokens are hidden markers placed in a prompt; if one shows up in the output, prompt content has leaked. They catch leakage after the fact, so they complement the other methods.

Most products combine several. For your choice, the useful questions are which traffic they inspect, how you tune them and where the data goes.

Comparison table

We kept tools from our guardrails and red teaming categories whose files record a sourced capability for prompt injection detection or testing, as our methodology describes. We do not run the products, so the groups below sort by shape and are not a ranking.

Classifier models you host

The Meta Llama protections suite detects prompt injections and jailbreaks with the Prompt Guard 2 classifiers Source, checked October 21, 2026: dev.meta.ai · 2026-10-21 (opens in a new tab) . Its license is a Custom license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , not a standard open-source license, so read the terms before you build on it. Best for teams that want open-weight safety classifiers and an agent guardrail framework on their own infrastructure.

Cloud provider guardrail APIs

These run next to your model endpoint and are the shortest path if you already build on that provider.

Azure AI Content Safety detects user prompt attacks that try to bypass system instructions or safety training Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . Best for teams on Azure or Foundry that want managed content moderation and prompt attack detection.

Google Cloud Model Armor detects prompt injection attempts that try to bypass system guardrails Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: docs.cloud.google.com · 2026-10-21 (opens in a new tab) . Best for teams on Google Cloud that want managed prompt and response screening in front of Vertex AI or their own model endpoints.

Amazon Bedrock Guardrails helps protect against prompt injection through the prompt attack content filter Source, checked October 21, 2026: aws.amazon.com · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: aws.amazon.com · 2026-10-21 (opens in a new tab) . Best for AWS teams that want managed filters for Bedrock models, or for other models through an API call.

Hosted firewalls and platforms

The vendor runs these in your request path. Check where prompts are processed before you send production traffic.

Lakera Guard detects direct and indirect prompt injection Source, checked October 21, 2026: docs.lakera.ai · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: docs.lakera.ai · 2026-10-21 (opens in a new tab) , and its status is renamed Source, checked October 21, 2026: docs.lakera.ai · 2026-10-21 (opens in a new tab) because the vendor documentation now uses the name Check Point AI Guardrails. On ownership, Check Point completed its acquisition of Lakera in the fourth quarter of 2025. Source, checked October 21, 2026: checkpoint.com · 2026-10-21 (opens in a new tab) Best for teams that want a hosted screening API, with a self-hosted option for stricter environments.

Pangea AI Guard blocks prompt injection with a Malicious Prompt detector Source, checked October 21, 2026: pangea.cloud · 2026-10-21 (opens in a new tab) . On ownership, CrowdStrike's fiscal 2026 Form 10-K states that it acquired 100% of the equity interest of Pangea Cyber Corporation on September 26, 2025. Source, checked October 21, 2026: sec.gov · 2026-10-21 (opens in a new tab) Best for teams that want a hosted guardrail API with configurable recipes.

Prompt Security blocks adversarial prompts with a real-time AI firewall Source, checked October 21, 2026: sentinelone.com · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: prompt.security · 2026-10-21 (opens in a new tab) . On ownership, SentinelOne reported in a Form 8-K dated September 8, 2025 that its acquisition of Prompt Security was completed on September 5, 2025. Source, checked October 21, 2026: sec.gov · 2026-10-21 (opens in a new tab) Best for security teams that already run SentinelOne and want AI usage controls and agent governance in the same console.

Lasso Security flags direct and indirect prompt injection in AI gateway traffic Source, checked October 21, 2026: lasso.security · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for teams that already route LLM traffic through an AI gateway and want inline detection and blocking without code changes.

Radware LLM Firewall inspects prompts for prompt injection and resource abuse before they reach the LLM Source, checked October 21, 2026: jp.radware.com · 2026-10-21 (opens in a new tab) , and it blocks jailbreak attempts at the prompt level Source, checked October 21, 2026: jp.radware.com · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: jp.radware.com · 2026-10-21 (opens in a new tab) . Best for teams that want a vendor-run firewall that screens prompts before they reach the model.

Testing your detector

Measure a detector on your own traffic before you rely on it. OWASP lists adversarial testing and attack simulations among its prompt injection mitigations. The tools below generate that evidence, and the testing and red teaming layer lists more.

Spikee tests LLMs, guardrails and applications for resistance to prompt injection Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for security teams that want a free toolkit to build and run prompt injection datasets against an LLM app or a guardrail.

Promptfoo scans for injections among more than 50 vulnerability types Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) , and it runs evals on pull requests through a documented GitHub Action Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . On ownership, Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI. OpenAI's developer documentation now says Promptfoo is part of OpenAI; we found no published closing date. Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) Best for developer teams that want one open-source CLI for prompt evals and red teaming.

The b3 benchmark provides crowdsourced attacks from the Gandalf Agent Breaker game, each placed in an AI application context Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its attack types include direct and indirect instruction override Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for teams choosing the model behind an agent, who want to compare how backbone models hold up against indirect attacks.

For wider attack tooling, see open-source AI red teaming tools, and for the question-and-answer version of this topic, prompt injection: questions and answers.

Archived and experimental projects

LLM Guard is archived Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) and Rebuff is archived Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) , so we do not recommend starting a new project on either. Vigil is listed as an experimental prompt injection scanner, so check its repository activity before you depend on it. Rebuff’s design is still worth reading for how layered detection and canary tokens fit together. The LLM Guard, Rebuff and Vigil pages list the facts we checked.

Design controls beyond detection

OWASP’s mitigation list reaches past filters, and each item limits the damage when a detector misses:

1. Constrain model behavior. Define the model’s role and limits in the system prompt.
2. Define and validate output formats. Check responses with deterministic code instead of trusting free text, which also covers improper output handling.
3. Filter inputs and outputs. The tools in this guide sit here.
4. Enforce least privilege. Keep API tokens and function calls in application code and give the model only the access it needs.
5. Require human approval for high-risk actions. A person confirms anything privileged, such as sending data out or changing records.
6. Segregate and label external content. Mark untrusted content so it carries less weight in the prompt.
7. Run adversarial testing. Repeat it whenever the prompt, the model or the tools change.

How to choose

The checklist is our analysis.

1. Decide where the detector must run. If prompts cannot leave your environment, shortlist classifier models and self-hosted options. If you build on one cloud, start with that provider’s API.
2. Ask which inputs it inspects. User prompts only, or also retrieved documents, tool output and images.
3. Check license and pricing model. The table shows both, linked to the vendor page that states each.
4. Check maintenance. Tool pages show the latest release and any ownership change.
5. Measure on your own traffic. Run an attack dataset and a sample of normal requests, and record what the detector blocks and misses.

For the wider set of runtime controls, read our guide to the best LLM guardrails.