Your agent — alone or shared
Most of this site is written for a security team. If what you have is a single
assistant you set up yourself — in a chat window, on a machine in your house,
reading your email and holding a few keys — this page is the short version.
If a colleague or household member talks to the same agent, that is a real path
too: label their messages source_kind: "colleague", not as you.
What actually goes wrong
Not someone attacking you. Your agent reads something — a forwarded newsletter, a calendar invite, a package README, a message in a group chat — and that text contains an instruction addressed to it. The agent has your inbox, your lights and a shell. The only thing between the two is you, reading an approval prompt at eleven at night.
Correcting your own assistant is not an attack
"Actually ignore what I said about the grocery list." "Stop — don't send that, I typed the wrong address." That is how people talk to their own agents, and it is word-for-word what an override attack looks like. Parse tells them apart when you say the message came from you.
Your configuration is yours
Asking whether your own system prompt still has the right timezone is a question about a file you wrote. Asking the agent to print it is a different act, and that one still refuses — whoever is asking.
Your messages do not leave, unless you ask
On every tier including Solo, full screening is the default. Pass "mode": "pattern-only" yourself if you want the deterministic layer alone: about
a millisecond, and no prompt text sent to any model provider. Every response
says which layers ran, so you can prove it per request rather than trust it.
It should still be working in three months
A free key renews itself whenever it is used and expires after 90 idle days,
failing closed. GET /v1/activity answers "is this thing even
running" in one call — the question nobody thinks to ask until it matters.
When it screens what your agent writes, the deterministic layer —
the one you get with mode: pattern-only — is quiet about ordinary writing: across
16 real newsletter lines — a venue address, a gate code, a
member's email, a "do not stare at the sun" safety note — it refused
none of
them (measured by prospect run 20, 2026-08-17). That is the output screen
(POST /v1/screen-output); the input screen is stricter by design.
What it refuses, and what it does not
The honest version, because "false positive" is the objection that decides this. On 17 lines of real operations text — third-party release notes naming a default password, a CVE advisory describing an authentication bypass, alert payloads, log tails — the deterministic layer refused none of them. It used to refuse 3. Those three are what prospect run 21, homelab operations, 2026-08-18 found, and fixing them is what changed the number — so read it as "those defects are gone", not as a general precision rate.
On 19 lines of financial-crime investigative prose (prospect run 22, crypto financial-crime investigation, 2026-08-18), the deterministic layer refused none of them. Full mode had refused 4 — an analyst describing an attack. The full story, with n, is on /docs#precision.
The two modes are a trade, not a speed setting
| Deterministic (opt-in) | Full (default on Solo) | |
|---|---|---|
| Speed | Milliseconds | 2–4 seconds |
| Where your text goes | Nowhere. It never leaves for a model provider | To the analysis model |
| Catches | Known shapes, reliably and reproducibly | Paraphrases and indirect attacks patterns miss |
| Costs you | Recall on novel phrasing | Seconds, and the occasional refusal of something harmless |
Neither one is the safe setting, which is why the choice is yours per call.
Solo runs full unless a call says "mode": "pattern-only".
The other half: what your agent sends
The digest your agent writes goes out under your name. If something it read slipped into what it wrote — an advert, a link, someone's address, a leaked key — the person who finds out is you, from a reader's reply. Screen the draft before it sends:
Install it
One command per runtime, and each one ends with a command that actually exercises your key. The install page has all six with your key filled in.
Screening a message from your own chat window looks like this. The two metadata fields are what turn on everything in the first two cards above:
source_kind: "user" is your own message in your own chat window.
A colleague or household member on the same agent is "colleague" —
never remapped to user+owner because the channel is Slack.
An email your agent read is "email". A page it fetched is
"web_page". A package README is "retrieved_doc". A tool
result is "tool_output". If you label everything as your own
conversation to make the warnings stop, you switch off the protection you
installed: we measured an injection planted in a forwarded newsletter drop from
a refusal to a warning when it was labelled first-party, and stay refused at full
score when it was labelled as email.
What it costs
Free covers a household agent outright: 10 requests a minute, no monthly cap, no account, no card. A personal assistant runs a few thousand screenings a month and that fits inside it with room to spare.
Solo at $12 buys three things a household actually
notices: no idle expiry, so an agent nobody is watching cannot quietly fail closed;
POST /v1/explain, which tells you in one sentence which words caused a
refusal instead of leaving you to guess; and GET /v1/digest, a monthly
count of what your agent read and what was refused — the thing you can show
the other people in the channel.