AI agent security
AI agents follow instructions wherever they find them: a web page, a README, an email, a pasted document. Gate sits between your agents and the model and screens every request and every response, so an attack is stopped before the model ever sees it and a leaked secret is redacted before it leaves.
Numbers on this page are from the benchmark paper, arXiv:2606.02959 (June 2026).
Agents fail in two ways that matter: they read something malicious and act on it, or they repeat something sensitive to a place it shouldn't go. The first is prompt injection, and its most damaging form is a hijacked tool call — an instruction hidden in a page or document that redirects what the agent does next. The second is leakage: API keys, customer PII, and PHI pasted into responses, logs, and downstream tools. Gate screens both directions for both failure modes, and enforces spend and rate caps on top.
A support agent summarizes a ticket thread for a handoff. The export includes customer email addresses. Gate redacts the values in the response before the agent's downstream tools or logs ever see them. The summary still arrives; the addresses don't.
The record shows response redacted · PII, and the redaction itself is part of the sealed entry.
A research agent opens a page whose hidden text instructs it to forward the conversation to an external URL. Gate flags the page content as an indirect injection and blocks it before the model reads it. The run continues on the remaining sources.
The record shows blocked · injection, source: tool output, with the offending content fingerprinted.
A batch job hits a failing call and retries all night. At the project's spend cap Gate returns a clean refusal the agent can handle, and the loop exits instead of compounding until someone wakes up.
The record shows cap enforced, with the request count and the exact amount metered against the limit.
Point your agent at Gate's endpoint and every message passes through a layered screening pipeline. Nothing to install in your codebase, nothing to retrain.
Allowed, flagged, blocked, or redacted — each decision is written to a hash-chained trail and anchored to Constellation Digital Evidence. For the operator, that's the record you show your boss, your customer, or an auditor. For the engineer, it's the record you pull when the incident review lands on your desk.
Most vendors quote a headline score without telling you the operating point. We publish ours the way you'd run it: one global threshold, a strict false-positive budget, and per-dataset results anyone can re-run. Goehausen & Sousa, arXiv:2606.02959, June 2026.
At the unconstrained max-F1 operating point (4.2% FPR), F1 rises to 98.7%. In plain terms: roughly 95 of 100 injection attempts caught at a 1-in-100 false-alarm cap, nearly 99 of 100 at a 4-in-100 cap.
Method, in one paragraph. One threshold is selected on held-out folds (max F1 subject to pooled FPR ≤ 1%, 5-fold cross-validation) and applied uniformly to all 16 datasets — no per-benchmark tuning, the way production traffic actually arrives. Every dataset is public and named in the paper. Generalization is stress-tested with leave-one-dataset-out cross-validation and a random-label control (shuffled-label AUC 0.5146, chance level): the model isn't memorizing benchmark quirks.
The clearest difference is false alarms. On the two public benign suites, Gate wrongly flags 2.7% and 1.4% of legitimate requests; Lakera Guard, the incumbent Check Point acquired for $300M, flags 12.4% and 17.4%. That is four to twelve times fewer false alarms, at matched false-positive rates where Gate also leads on detection.
| Measure | Gate AI | Lakera Guard |
|---|---|---|
| Benign over-block rate, NotInject (lower is better) | 2.7% | 12.4% |
| Benign over-block rate, WildGuard-benign (lower is better) | 1.4% | 17.4% |
| Mean F1 at matched FPR (deepset, gentel-jailbreaking, gentel-goal-hijacking, gentel-prompt-leaking) | 96.6% | 83.7% |
| deepset F1 at matched FPR 0.7% | 88.7% | 82.3% |
All values from the per-dataset table of arXiv:2606.02959.
Screening that adds seconds per request doesn't survive contact with an agent loop. Gate adds 53 ms at the median and 60 ms at p90; its 104 ms mean is the lowest in the paper's comparison corpus, against Lakera Guard's 140 ms.
Full detail in the privacy policy and terms.
Those are routers and observability layers, and they're good at it. Gate is the screening layer: benchmarked injection defense, credential and PII redaction, enforced caps, and a tamper-evident record. They compose. LiteLLM and most proxies speak to OpenAI-compatible endpoints, so you can point your existing setup at Gate and keep it.
Logs can be edited or deleted by whoever holds the keys, which is exactly what an auditor will point out. Gate's audit trail is hash-chained and anchored to Constellation Digital Evidence, so a record can be verified independently and a deletion shows up as a deletion. The ledger stores cryptographic fingerprints, never your content.
Yes. Bring your own keys and your existing provider agreements stay in place, or run models through Gate's keys on pay-as-you-go.
Sign up, point your tools at Gate with Gate Connect or one line of config, and every request after that is screened.