injection-guard

An open-source plugin for the Hermes agent that detects prompt injection in fetched web content — so an AI agent treats instructions hidden in a web page as data, and does not follow them.
https://github.com/gweber/hermes-injection-guard

The problem

As soon as an agent reads web pages, a crafted page can try to hijack it: "ignore all previous instructions…", hidden role changes, exfiltration requests. Hermes ships strong guards (command scanning, SSRF/metadata guards, homograph-domain blocking) — but no content-level scan for prompt injection. This plugin fills exactly that gap.

How it works

– A transform_tool_result hook fires when a content tool (browser, web_extract …) returns text.
– Classifier protectai/deberta-v3-base-prompt-injection-v2 (Apache-2.0) — small, CPU, lazy-loaded.
– On a hit: a non-blocking "treat as data" warning is appended to the result (optional block mode).
– Skills, terminal and file tools are intentionally exempt.

Installation

pip install transformers torch sentencepiece
hermes plugins install gweber/hermes-injection-guard
hermes plugins enable injection-guard

The model (~700 MB) downloads from Hugging Face on first hit and is cached; it runs on CPU. If transformers/torch are missing, the plugin loads cleanly and the hook is a no-op.

An honest note

Injection classifiers are not perfect (false positives/negatives, evadable — especially for novel attacks). One layer in defense-in-depth, not a silver bullet: least-privilege execution and "content is data" prompting belong alongside it.

Test it yourself

The live test page contains a real prompt-injection payload. If you let an agent fetch it, a guarded agent marks the content as data and does not follow it:
https://www.webersheim.de/injection-guard-test.html

License

MIT · Classifier: ProtectAI (Apache-2.0) · Code & docs:
https://github.com/gweber/hermes-injection-guard