Prompt injection is social engineering for AI. Malicious instructions are hidden inside content an agent reads - a file, a web page, a ticket, an MCP server tool response - and the agent follows them as if they came from the user. No exploit and no malware are required.
Yes. Here's a real-world pattern that slips past every traditional security control. An AI coding agent is asked to read a README file to install a package. Hidden inside a comment block — invisible to a human reviewer — an attacker has planted instructions that tell the agent to read cloud credentials from disk and send them to an attacker-controlled server. The agent reads the comment as if it were part of the setup instructions, not as untrusted data, and executes them using legitimate tools like npm and curl.
To an EDR agent, everything looks normal — npm is a trusted binary. To a network gateway, everything looks normal — the POST request is a valid HTTPS call. The only place to catch this attack is at the point of execution on the endpoint, comparing what the agent is about to do against what the user asked it to do. That's where Backslash operates.
Direct injection comes from whoever is typing to the agent. Indirect injection arrives inside content the agent reads while working, and it is the harder case, because the instruction enters through a source nobody was treating as a security boundary.
An agent's working memory holds everything as text - the user's request, file contents, command output, tool responses. Nothing marks which text came from a trusted user and which came from a file the agent happened to open. Reading instructions out of plain language is the whole point of the tool, which is why the weakness is structural rather than a bug.
Any content an agent reads. Source and README files, web pages and documentation it fetches, issues and tickets, MCP server tool responses, and shared context such as rules files and saved prompts, where a single change affects everyone using them.
No. It follows from how language models use context, so there is no single bug to fix. Defense is layered: limit what an agent can read, limit what it can do with what it reads, and watch what it actually does. The last layer is where Backslash operates.
EDR watches processes and binaries. An injected instruction produces a legitimate process making legitimate calls, so nothing looks wrong. AI gateways inspect network traffic, and much of the agentic fabric - local MCP servers, Skills, hooks, rules files - never crosses the network at all.
Backslash operates where agents load instructions, select tools, and execute actions. It inspects the full agentic fabric on employee endpoints - Skills, MCP servers, hooks, rules files, connectors - for hidden instructions and unsafe patterns, then verifies agent behavior against intent at runtime.
Yes. Backslash blocks the resulting action at the endpoint before it executes: unauthorized code execution, sensitive data access, privilege escalation, or transmission to an unapproved destination. This holds even when the agent is using a legitimate, trusted tool to carry it out.
Yes. Backslash parses Skill files and their supporting scripts, and assesses MCP servers and their exposed tools, identifying hidden instructions, malicious intent, and behavior that exceeds what the component advertises.
A forensic-ready audit trail connecting prompts, loaded Skills, MCP interactions, tool calls, processes, and resulting actions. That chain is what makes an incident answerable, and it supports both incident response and compliance reporting.
Privacy is important to us, so you have the option of disabling certain types of storage that may not be necessary for the basic functioning of the website. Blocking categories may impact your experience on the website. More information
