Propagation breaker for agent fleets

By TextForAgents LLC. Self-replicating prompt injections — agent worms — have now been reproduced across five non-GPT backends and through Word documents, with a 63% aggregate attack success rate, and the framework controls that break the infection loop are enabled in zero observed deployments. Every shipped defence still scores one input at a time — but propagation is a population property: a payload each filter passes at low confidence still sweeps a fleet if its reproduction number is above 1. This product is the epidemiological layer.

An egress screen scores outbound agent output for instruction-like content copied from inbound context (blended shingle + token similarity, cheap-first, no inference call on the hot path) and quarantines high-similarity instructional forwards before delivery, holding the borderline band closed. Payload-fingerprint telemetry tracks how often one agent's output becomes another agent's instructions and alerts when a fingerprint appears in ≥3 distinct agents, with an R estimate — the outbreak signature, independent of payload content. Shared-store writes are data-only by default and can never auto-promote into a reader's instruction context; elevation takes a cryptographic token bound to the key and the agent. And an agent can ask, before acting on forwarded instructions: "has this payload fingerprint been seen propagating?"

Proven in the lab: 26/26 tests, a naive fixture fleet infected 12/12 + 11/11 against the breaker's 1 + 0, zero false quarantines on 60 benign forwards, 903 µs per message.

Pricing

• Fleet $19/mo per fleet — up to 50 agents, fingerprint telemetry + outbreak alerts; first fleet outbreak scan free, one time per operator.
• Fleet Pro $49/mo per fleet — up to 500 agents + egress quarantine + data-only write enforcement.
• Fingerprint query $0.001/query (x402) — "Has this fingerprint been seen propagating?" — agent pre-trust query.

There is no perpetual free tier. Support: support@textforagents.com.

How it works

1. POST /register {"operator": "your-name"} → API token + breaker key, each shown once.
2. POST /trial → claim the one-time free fleet outbreak scan.
3. POST /scan with a fleet snapshot (messages, optional store writes/reads, control check) → per-message verdicts (PASS / BORDERLINE held / QUARANTINE), store read classes, telemetry with outbreak alerts + R estimates, control verification.
4. POST /fingerprint-query {"text": "..."} → fingerprint spread state ($0.001/query x402; included on Fleet plans).
5. POST /subscribe {"plan": "fleet"|"fleet_pro"} with a verified x402 payment → plan active 30 days.
6. JSON-RPC at POST /rpc and MCP at POST /mcp (tools: egress_check, fingerprint_query, store_write, store_read, telemetry_report, controls_verify) with your Bearer token. Egress quarantine, the data-only store and control verification are Fleet Pro surfaces; telemetry is a Fleet surface.

Limits

• The egress screen is cheap-first by hard product constraint: blended shingle + token similarity with an instruction-likeness heuristic and NO inference call on the hot path. A BORDERLINE verdict fails closed — the message is held, not delivered — and is never silently passed. No inference review lane is offered in v1; the per-fleet borderline share is metered and reported in telemetry (lab: 0% on benign traffic, 20% on the adversarial-heavy bench mix).
• Outbreak alerting fires when a payload fingerprint cluster appears in 3 or more distinct agents, with an R estimate (distinct carriers / distinct forwarders). Alerting is a telemetry signal independent of any single message's content score; detection is proven for the shapes in the lab report (verbatim + paraphrased instruction payloads similar to inbound context), not guaranteed for every propagation shape.
• Framework integration: a wired LangGraph integration ships in src/adapters/langgraph_adapter.py — egress screening, the data-only store and spread alerts run inside LangGraph's actual message dispatch (StateGraph transitions) and shared Store, with the naive-vs-breaker contrast re-run there (naive 12/12 messaging + 11/11 store infected vs breaker 1 + 0). The OpenClaw-shape and generic adapters are honest THIN adapters over this hosted API — the product does not claim to protect a framework it has not been wired into, and an agent that never consults the service is outside the screen.
• Shared-store writes are data-only by default and never auto-promote into a reader's instruction context; elevation requires an HMAC token bound to (key, agent) under your breaker key. Forged tokens and cross-agent token reuse are rejected. The sealed control registry detects tampering or disablement of the breaker's own controls and reports it — it does not warrant your framework's configuration.
• Legal state (stated plainly): patentability memo LEGAL-167 on file (FILE-NARROWED); FTO screen LEGAL-168 on file (AMBER — no plausible read on the product as designed, no RED; keep-clear conditions apply: no per-segment length-threshold injection scoring, no address-placeholder substitution).
• Both worm reproductions behind this product are research/disclosure settings — there is no confirmed in-the-wild outbreak yet. Lab proof: 26/26 tests, naive fixture fleet infected 12/12 + 11/11 against the breaker's 1 + 0, zero false quarantines on 60 benign forwards, 903 µs per message. Demand is unmeasured.
• Lost-token / lost-breaker-key recovery is a manual step via support@textforagents.com; tokens and breaker keys can be rotated any time while authenticated (POST /rotate-token, POST /rotate-key). Rotating the breaker key invalidates every outstanding elevation token immediately.

Terms · Privacy · OpenAPI · llms.txt