Prompt-injection regression tests in CI
Your agent has an attack surface and no regression test for it
Every tool description, retrieved document and user message is untrusted text that reaches a model with permissions. Injection Range attacks that surface on every pull request and tells you what got through.
The problem
Prompt injection is tested the way security was tested in 2004: once, by a consultant
Teams run a pentest before launch, fix what it finds, and then ship two hundred changes to prompts and tool manifests with nothing checking whether the fix still holds. The attack surface changes weekly and the test does not change at all. Meanwhile the naive defence — grep for suspicious phrases — flags every tool that legitimately mentions an API key, so nobody looks at the output.
The insight
Screening a manifest is a multiple-testing problem, and everybody gets it wrong
Scoring text for injection is easy. Doing it across four hundred tool descriptions without drowning the reviewer is not, because a rule that fires on one item in fifty will fire eight times on a clean manifest. Injection Range scores each candidate against a calibration corpus of your own first-party descriptions, converts that to an empirical p-value, and applies Benjamini-Hochberg across the batch. The output is the handful that survive correction, which is a queue somebody will actually work through.
Seven independent detectors — role override, credential seeking, exfiltration channel, egress primitive, tool coercion, delimiter break, obfuscated payload — with an interaction term for credential-plus-egress, scored against a first-party benign corpus for empirical p-values, then BH-corrected across the manifest.
How it works
Four steps, no data science team
Tool descriptions, system prompts, retrieved document templates. Anything untrusted that reaches the model.
Your first-party descriptions become the null distribution, so a tool that legitimately mentions credentials does not read as an attack.
A new tool with a planted instruction fails the build, with the matched span quoted.
Every payload you find is added to the range, so the same trick never lands twice.
Who it is for
Whoever signs off on shipping the agent
Teams whose agents read text they did not write — third-party MCP servers, retrieved documents, user uploads, email. Anyone who has installed a tool from a registry.
Pricing
- –Manifest scan
- –BH-corrected findings
- –Public payload corpus
- –CI gate with pass/fail
- –Private calibration corpus
- –Retrieved-document scanning
- –Slack alerts
- –Self-hosted runner
- –Custom detectors
- –Payload authoring
- –Quarterly review
Competition
What exists, and what it does not do
| Who | What they do | The gap |
|---|---|---|
| Lakera, Prompt Security, Robust Intelligence | Runtime guardrails that filter prompts and responses in production. | They block at request time, which is necessary and separate. Neither tells you that the tool description you merged this morning created a new hole. |
| Garak, PyRIT and open-source red-teaming | Batch red-team a model with a library of attacks. | Built for models, run manually, and they produce a report rather than a gate. Nothing pins them to your manifest or your CI. |
| Traditional SAST and secret scanners | Scan code and configuration for known-bad patterns. | They read code. The attack lives in prose that is data to your pipeline and instructions to your model. |
| A pentest before launch | What most teams do, once. | Correct on the day and stale by the next deploy. The attack surface changes with every prompt edit. |
Detection by pattern is a losing game against an adaptive attacker, and we should say so plainly: this raises the cost of an attack, it does not prove absence. The honest framing is regression testing — the payloads you have already seen must never work again — rather than guaranteed protection, and a buyer who wants the guarantee will be disappointed. Commercially the risk is that runtime guardrail vendors extend backwards into CI, which is a shorter step for them than building a runtime is for us. The wedge is calibration on first-party text, which they are not doing and which is what makes the output usable.
Market
Attached to the application security budget, alongside the SAST line nobody questions
Every team that installs a third-party tool server is exposed, and the number of those is compounding. Fifteen hundred teams at Team pricing is $12.6M ARR before any enterprise contract.