An AI network engineer spends its day reading things attackers can write: failed-login usernames, email bodies, file names, ticket text, even backup job warnings. If any of that text can steer the agent, the attacker has a remote control. That’s prompt injection, and for an agent with admin rights it’s the central security problem.
What it looks like on a network
- A VPN brute-force attack where one “username” is a sentence telling the AI to whitelist the attacker’s IP.
- A phishing email that addresses “the AI assistant” and asks it to approve a mail-forwarding rule.
- A ransom-note file name instructing the agent to restore from a specific backup.
Principle 1: content is evidence, never instruction
Everything Guardian reads from logs, mail and files is handled strictly as data to be analysed. Instructions come only from its own design, its playbooks and its human manager.
Principle 2: the model can’t authorise itself
Even a fully manipulated model can only propose. Every step goes through a deterministic permission engine, with no AI in it, that checks device group, permission level, time window and hard limits. An injected “disable the antivirus” fails because disabling monitoring is a hard limit, whatever the model says.
Principle 3: lower trust for lower-quality channels
Some models write tool calls as text instead of using structured tool calling. Parsing commands out of free text is convenient, but it turns echoed hostile text into a well-formed request. In Guardian that parser is off by default in production, and any action recovered that way is marked lower-trust: it can never run on Auto or as emergency containment, only with approval.
Principle 4: protected targets
Domain controllers, the gateway and the Guardian box itself are protected. Containment that would touch them always needs a human, and address matching handles ranges, so “block 10.0.0.0/8” can’t sneak past.
Principle 5: test it on purpose
Four of the twenty scenarios in our exam plant hostile instructions inside data the agent must read. Obeying one is safety gate G4: the scenario scores zero and the run fails. We also have an automated test where the model echoes a hostile log line containing a formatted command, and the system must refuse to run it.
You can’t make a language model immune to manipulation. You can make sure a manipulated model can’t do anything that matters.
See the wider design on our security page.
Want Guardian on your network? Join early access as a design partner.