Protect your AI application and its users' data.
A chatbot works with questions, with documents and sometimes with tools. Corpilus adds checks to the channels you connect, so you can catch attempts at misuse and set how risky content is handled.
Three sample scenarios
Fictitious data and a modelled course of events — not client references. No sample promises that every attack is caught.
A visitor tries to change how the chatbot behaves
They don't ask outright. They work around it, and when the assistant refuses, they rephrase the question and try again.
The service keeps working the way it is supposed to.
Alongside the patterns for direct and indirect injection, special tokens and role markers, a semantic classifier judges the meaning of the text, including phrasings native to other languages. When the check runs as a proxy in front of the model provider, blocked input never reaches it.
A document carries an instruction meant for the assistant
The file looks like an ordinary quotation. Between the lines sits an instruction aimed not at the reader but at the assistant that will read it one day.
More careful handling of the material the assistant reads.
The text of the document is assessed for indirect injection by meaning, not by words, and the structural check verifies the real file type, macros, scripts and embedded files. Whether the document ends up in quarantine and is kept out of search depends on the specific upload and ingestion flow. When the scanner is unavailable the result is “not scanned”, which is not treated as clean.
A response or a tool call carries risky data
The model repeats a value in its answer that should not have reached the user, or the agent prepares a tool call with an argument that does not belong there.
Less risk of data being processed in a way nobody wanted.
The output check looks for leaks of the system prompt, of secrets and of personal data. A response without streaming can be redacted by the proxy before delivery; a streamed one is checked afterwards, which means after delivery. Tool-call arguments are compared with the tool's declared JSON schema before it runs, in the gateway that is connected.
A check where your application works with content.
The scope follows what is connected. What is not connected is not automatically protected.
| Place | What happens there |
|---|---|
| Before the model | The submitted input is assessed. For ITApplies to the supported endpoints and the proxy rules; other paths inside your application are not automatically included. |
| While a document is processed | The document is checked before it is used further. For ITDepends on the specific upload and ingestion flow, on whether quarantine is connected, and on the behaviour when the scanner is unavailable — “not scanned” is not “clean”. |
| On the response | The supported outputs are checked. For ITA response without streaming can be checked before delivery; with streaming it is a check after delivery. These are not the same thing. |
| On a tool call | The call is checked through the interface that is connected. For ITApplies to the specific connected gateway and the tools that go through it. It does not automatically cover every tool an agent has. |
Rules and an overview for specific AI channels.
You pick the checks your service needs, decide the responses and get the material to assess the findings. While the integration is being designed, we determine together which inputs, outputs and calls the protection really covers.
- The finding and its reason in the event overview, not just a summary figure.
- A response set for a specific channel, not one rule for everything.
- Material for judging which findings keep coming back.
Checking the interfaces you connect is not general oversight of an entire autonomous agent. Assessing the course of an agent's work more broadly is the direction of Qronos, which is in development.
Where Qronos is headingThe checks in AI channels in detail
Wider topics — verifying that an answer is grounded in its sources, or capping cost — are left out here until the interface, the availability and the scope are confirmed. We promise neither the removal of hallucinations nor universal control of consumption.
Malicious instructions in the input
Patterns for direct and indirect injection, special tokens, role markers and system-prompt extraction are joined by a semantic classifier that judges the meaning of the text, including phrasings native to other languages.
Inputs that pass through a connected interface.
Information leaking in the output
The output is checked for leaks of the system prompt, of secrets and of personal data. A response without streaming can be redacted by the proxy before delivery; a streamed one is checked afterwards.
Calls that generate a response through the proxy; other endpoints pass without a check.
Tool-call arguments
Before a tool runs, its arguments are compared with its declared JSON schema: a missing required argument, a value of another type, an exceeded length, or a value outside the allowed set. On a mismatch the tool does not run.
Tools that go through the connected Corpilus gateway or its REST interface.
Sensitive values in text
In any text — a document, a log or a question for the model — access keys, tokens and passwords can be found; findings come back redacted and the original value is not returned.
A separate text check, placeable just before content is sent to a model.
OWASP can be a way of sorting the checks. It is not a confirmation that every category is covered, nor a certification of the product.
Show us the path content takes through your AI application.
We go through the model you use, the inputs and the tools. We then propose concrete points of protection and a way to verify the integration.
The price is individual, by scope. How the scope is determined