Promptinjection is social engineering for AI. Malicious instructions are hiddeninside content an agent reads - a file, a web page, a ticket, an MCP servertool response - and the agent follows them as if they came from the user. Noexploit and no malware are required.
Yes.Here's a real-world pattern that slips past every traditional security control.An AI coding agent is asked to read a README file to install a package. Hiddeninside a comment block — invisible to a human reviewer — an attacker hasplanted instructions that tell the agent to read cloud credentials from diskand send them to an attacker-controlled server. The agent reads the comment asif it were part of the setup instructions, not as untrusted data, and executesthem using legitimate tools like npm and curl.
Toan EDR agent, everything looks normal — npm is a trusted binary. To a networkgateway, everything looks normal — the POST request is a valid HTTPS call. Theonly place to catch this attack is at the point of execution on the endpoint,comparing what the agent is about to do against what the user asked it to do.That's where Backslash operates.
Directinjection comes from whoever is typing to the agent. Indirect injection arrivesinside content the agent reads while working, and it is the harder case,because the instruction enters through a source nobody was treating as asecurity boundary.
Anagent's working memory holds everything as text - the user's request, filecontents, command output, tool responses. Nothing marks which text came from atrusted user and which came from a file the agent happened to open. Readinginstructions out of plain language is the whole point of the tool, which is whythe weakness is structural rather than a bug.
Anycontent an agent reads. Source and README files, web pages and documentation itfetches, issues and tickets, MCP server tool responses, and shared context suchas rules files and saved prompts, where a single change affects everyone usingthem.
No.It follows from how language models use context, so there is no single bug tofix. Defense is layered: limit what an agent can read, limit what it can dowith what it reads, and watch what it actually does. The last layer is whereBackslash operates.
EDRwatches processes and binaries. An injected instruction produces a legitimateprocess making legitimate calls, so nothing looks wrong. AI gateways inspectnetwork traffic, and much of the agentic fabric - local MCP servers, Skills,hooks, rules files - never crosses the network at all.
Backslashoperates where agents load instructions, select tools, and execute actions. Itinspects the full agentic fabric on employee endpoints - Skills, MCP servers,hooks, rules files, connectors - for hidden instructions and unsafe patterns,then verifies agent behavior against intent at runtime.
Yes.Backslash blocks the resulting action at the endpoint before it executes:unauthorized code execution, sensitive data access, privilege escalation, ortransmission to an unapproved destination. This holds even when the agent isusing a legitimate, trusted tool to carry it out.
Yes.Backslash parses Skill files and their supporting scripts, and assesses MCPservers and their exposed tools, identifying hidden instructions, maliciousintent, and behavior that exceeds what the component advertises.
Aforensic-ready audit trail connecting prompts, loaded Skills, MCP interactions,tool calls, processes, and resulting actions. That chain is what makes anincident answerable, and it supports both incident response and compliancereporting.
Privacy is important to us, so you have the option of disabling certain types of storage that may not be necessary for the basic functioning of the website. Blocking categories may impact your experience on the website. More information
