Now running on macOS

An immune system
for your AI.

IngestShield installs like antivirus and sits between your agents and the cloud — reading what they read, and watching what they do.

Request the brief Watch it work ›
IngestShield
Review
Always allow
Claude Code is about to send this
claude-haiku-5-5 · 2026-11-12T19:41:38Z
1 of 3 waiting
Message34 bytes
triage issue #412 and fix the build
mcp__github__get_issue2 KB47 hidden characters shown as ⟨U+…⟩
github.com/acme/build-tools/issues/412
Build fails on M3 when cache is cold. ⟨U+E0049⟩⟨U+E0067⟩⟨U+E006E⟩⟨U+E006F⟩⟨U+E0072⟩⟨U+E0065⟩… Steps to reproduce attached.
97%
Likely prompt injection · quarantined
Hidden tag text addressed to an AI, asks for ~/.ssh. Firebox: tried send_email.
New
Release
Keep quarantined
The review window from today’s build, with the verdict layer we’re shipping next.

Your agent reads a README. An issue. An email. A web page. Any one of them can quietly tell it to send your keys somewhere new. Every agent that reads is exposed.

How it works

Five checks, in milliseconds.

Static analysis
Sees what you can’t.
Looks fine.⟨U+200B⟩⟨U+E0041⟩⟨U+E0049⟩ Thanks!
Invisible Unicode, hidden HTML, exfil links and poisoned tool descriptions — under 5 ms.
Labeling
Knows who’s talking.
You Read · src/ MCP · GitHub Web · unknown Email · external
Every segment carries its origin. Text from outside is treated as data, never as orders.
Prediction
97%
A Jev‑class model returns a calibrated probability, not a guess — locally, in tens of milliseconds.
Firebox
When in doubt, detonate.
Suspicious text runs inside a sealed model with fake tools and decoy secrets. If it reaches for them, it never reaches yours.
Behavior watch
Then it watches.
Emailing someone new? Reading ~/.ssh? Pushing to a strange remote? Paused until you say so.
The network

One infection.
Everyone immune.

HOUR 0
One free shield meets a new attack.
Blocked by the behavior layer, traced back to the text that caused it.
MUTATE
We explode it into thousands of variants.
Reworded, translated, encoded, split across fields, hidden in alt text and code.
TRAIN
Grouped by intent, not wording.
So the next rewrite of the same trick still matches.
UPDATE
Every shield gets the vaccine.
A signed update reaches every individual and every company.
Each dot is a shield. An attack works once.

Free for people.
Essential for companies.

For individuals
Free, forever.
Download, approve, done. Every install adds a sensor to the network that protects everyone else.
Static analysis, labeling, prediction
Behavior watch and approvals
Daily signed updates
For organizations
Every laptop, one policy.
Deploy through MDM. Set per‑agent rules. See every block, every approval, every source.
Firebox detonation
Fleet policy and audit trail
SOC and SIEM integration

From lab demos
to the wild.

Feb 2023
Bing Chat leaks its system prompt. Injection becomes a party trick.
2025
EchoLeak, CVSS 9.3: a single email exfiltrates Microsoft 365 Copilot data, zero clicks.
2025
Coding agents: injected READMEs and issues flip auto‑approve and run code on developer machines.
Feb 2026
Clinejection: first confirmed in‑the‑wild supply‑chain compromise. ~4,000 downloads of a poisoned release.
Summer 2026
Honeypots catch live injection chains ending in shell access and credential theft.

The labs agree it can’t be fully fixed inside the model. Big security bought enterprise gateways — Protect AI, Lakera, CalypsoAI, Prompt Security. No one protects the agent on your own machine.

0 ms
measurable added latency on Claude Code in today’s build.
~1 s
to fail open. Your agent never stops working because of us.
54
engine tests passing across the Rust core and macOS extension.

Make every attack
a one‑time event.

We’re raising to bring IngestShield to Windows and scale the variant engine.

Request the investor brief