LLM Security DemoThreat scoring for AI agent inputs · R1–R4
Step 1 of 2

Enter the passcode

This demo is not public. Ask the organiser for the passcode.

Step 2 of 2

Connect your Cursor API key

The LLM judge runs on the Cursor API with your own key. The key stays in this browser tab's memory and is sent with each analysis over HTTPS. The server uses it for that request only and does not store or log it. Reloading the page forgets it.

Create a key at Cursor Dashboard → Integrations → API keys.

Demo

Is this input a threat to an AI agent?

Paste a user prompt and, optionally, the context the agent will read. Three independent layers score it for four risks, and the LLM judge explains why.

Try an example:

Results appear here.

How the score is built

LAYER 1 · RULES

Signature rules

Regex and Unicode checks modelled on Vigil's YARA rules, Rebuff's heuristics, LLM Guard's invisible-text scanner and LlamaFirewall's HiddenASCII scanner. Instant and deterministic.

LAYER 2 · CLASSIFIER

DeBERTa injection model

protectai/deberta-v3-base-prompt-injection-v2, the model inside LLM Guard's PromptInjection scanner, run locally with ONNX Runtime. Scores R2 on the prompt and R1 on the context.

LAYER 3 · LLM JUDGE

Cursor API reasoning

A tool-free Cursor agent reads the input as data, in the style of LlamaFirewall's AlignmentCheck, and returns a score, reasoning and evidence per risk.

Final score per risk = the LLM judge's score, but never lower than 80% of the strongest rule or classifier signal, so an input that fools the judge cannot hide what the deterministic layers saw. Bands: 0–29 allow · 30–59 review · 60–79 block (high) · 80–100 block (critical). No model is trained; nothing you enter is stored.

R1 Prompt injection through data — instructions hidden in content the agent reads.
R2 Direct prompt injection and jailbreaks — the user tries to make the agent ignore its rules.
R3 Hidden context exposure — attempts to reveal instructions, rules, tools or secrets.
R4 Poisoned retained context — attempts to plant false or malicious long-term memory.