AI Cordon screens every outside document for hidden instructions before your AI sees it — so you can connect email, web and uploads without opening a backdoor.
Your AI systems read text that strangers wrote: emails, files, web pages, tool output. One sentence in that text can be addressed to the model instead of to you.
One prepared email made Microsoft 365 Copilot leak internal files, with no click.
EchoLeak, CVE-2025-32711 →In our test, 8 of 12 agent models filed a payment that a planted line in an ordinary business email asked for.
Our test with 12 agent models →In our test, 6 of 10 agent models ran a command to install a tool for themselves: a server, a package, a script. The tool stays after the task ends.
Our test with 10 agent models →Some models obey, others refuse, and newer is not always safer. You can’t tell in advance which will hold — and it changes with every model update. So the check sits outside the model. Which models held in our tests →
Agents, models and tools change; the border they share doesn’t. AI Cordon checks every outside document once, at that border, and flags any that carries a hidden instruction before anything inside reads it. Your AI does what your people ask, not what a document tells it.
Flagged means the API answers is_injection: true with a probability and the line that triggered it. Your system decides what happens next: drop the document, cut the line, or send it to a person.
We don’t match words. A compact open model reads the document once, and the detector reads how the model understands it: whether it sees a command.
Four documents through the live API. Each gets a verdict, a probability and the part of the text that triggered it, so a person reviews one line instead of the whole email.
shaded — the part of the document the detector flagged; underlined — the instruction that was actually planted. Verdicts, regions and probabilities are the live API’s answers, AI Cordon Intent 2.1.0.
Count it on a real stream: 10,000 documents a day.
| false alarms | alerts a day | what it means |
|---|---|---|
| 1% | 100 | a full-time job, or a detector people switch off |
| 0.1% | 10 | someone's morning, every morning |
| 0.01% | 1 | five minutes a day — where we run |
On 141,856 clean documents held out of training — business mail, news, encyclopedia articles, reviews — Intent raised 10 alarms: fewer than one in 10,000. On the 203 genuine emails of Microsoft's LLMail-Inject test, none.
Measured at the service’s own threshold on documents held out of training. Every number carries a 95% interval.
One false alarm per 10,000 clean documents: the operating point every number below is read at.
The share of hidden instructions caught at that threshold — 5,262 injections inside emails, news, wiki pages and reviews. On the clean side it flagged 10 of 141,856.
24,559 attacks written by people against live defences in Microsoft’s open challenge, caught at the service’s operating point. None of its 203 genuine emails was flagged.
The most the model reads in one pass. A document sent to the API is up to 5,000 characters, far below that, so it is read whole — no slicing, no stitching verdicts together.
5,262 injections · 141,856 clean documents · LLMail-Inject: 24,559 attacks, 203 genuine emails · AI Cordon Intent 2.1.0, October 2026
On Microsoft’s own benchmark, by the rules of its paper: 99.5% and 99.7% of attacks caught, against 67.8% and 48.7% for Azure Prompt Shield v2. How we measured →
Call the API after you fetch a document and before you add it to the prompt. If is_injection is true, leave the document out or send it to a person.
curl -X POST "https://app.ai-cordon.com/api/v1/check" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "text": "The RAG chunk or agent message you want to check...", "detector": "intent" }' # → { "is_injection": true, "score": 0.998, "raw_score": 109.1, # "verdicts": { "fpr_1e-04": true, "fpr_1e-03": true } }
import requests url = "https://app.ai-cordon.com/api/v1/check" headers = {"Authorization": "Bearer YOUR_API_KEY"} payload = { "text": "The RAG chunk or agent message you want to check...", "detector": "intent", } response = requests.post(url, json=payload, headers=headers) result = response.json() if result["is_injection"]: print(f"Injection detected! Score: {result['score']:.2f}") else: print("Document is safe to send to the LLM.")
const response = await fetch("https://app.ai-cordon.com/api/v1/check", { method: "POST", headers: { "Authorization": "Bearer YOUR_API_KEY", "Content-Type": "application/json", }, body: JSON.stringify({ text, detector: "intent" }), }); const result = await response.json(); if (result.is_injection) { console.warn(`Threat detected (score: ${result.score.toFixed(2)})`); } else { console.log("Text verified and safe."); }
€40 per million documents. Any text up to 5,000 characters costs the same — ten words or five thousand characters. No subscription; start with 50,000 free documents.
Try the detector on your own data — no card, no commitment.
Top up your balance and pay only for the documents you check. No subscription. Credits never expire.
For teams that need the detector inside their own infrastructure or at volume.
Split them into parts of up to 5,000 characters; each part is one document. A longer text in one request is refused with document_too_large and not billed.
Clean documents are not stored. When a document is flagged, we keep the flagged fragment, up to 2,000 characters, to review false alarms. Processing runs within the EEA.
No. A request refused for a bad key, an empty balance, a size or rate limit is not charged.
Each API key has its own rate and parallel-request limits, shown in your dashboard. We raise them on request.
Today: what your AI reads. Next: what it does.
Create an account and you get an API key and 50,000 free documents.