Sabrix AI Proxy sits between your application and any LLM provider — OpenAI, Anthropic, self-hosted — checking every prompt, every response, and every agent tool call at the argument level. One line of integration. No unreviewed action reaches production.
Each tool above was already allowlisted by name. What varies — and what gets checked — is the argument.
A prompt-injection flaw let attackers exfiltrate customer data through ordinary form inputs handled by the agent.
The same class of injection reached Copilot, again via routine input fields, again pulling data out through the agent's own actions.
A disclosed CVE showed "allowlisted" tool commands could still be weaponized — the allowlist checked the tool's name, never its arguments.
The common thread: none of these were stopped by scanning what the model said. They were stopped — or should have been — by governing what the agent was allowed to do.
base_url = "https://can.proxy/v1" client.chat(messages)
card: "4111 1111 •••• 1111" → redact: PII.card_number
"ignore prior instructions…" → flag: injection_pattern
tool: db.query() ✓ allowlisted args: "DROP TABLE users" → policy: BLOCKED
complexity: low → route: local-model
response → scan → OK → log: sha256(entry) chained
Every tool call an agent attempts is parsed for destructive SQL, shell execution, path traversal, and SSRF patterns at the argument level — regardless of whether the tool itself is allowlisted — plus a velocity circuit-breaker that halts an agent issuing an abnormal burst of actions and a network-level egress allowlist that blocks unauthorized destinations outright.
Hardcoded API keys, tokens, SSNs, card numbers, and email addresses are detected and redacted or blocked before they leave the network — 12 secret-pattern families plus standard PII categories.
A combined pipeline — fast pattern-matching plus a finetuned semantic classifier — checks both the request and the model's own response, including known-phrase jailbreaks and semantically-disguised variants.
Per-organization, per-team, and per-route rules, hot-reloadable with zero downtime and zero measured impact on in-flight requests.
A classifier scores every request — safe, uncertain, or flagged (handled by the security pipeline, not routing) — in the same fast inspection pass, so the decision adds no meaningful latency. An explicit override or policy rule wins if set; otherwise safe traffic goes to your own cheap model, everything else to a premium provider. Without it, every request bills at premium rates regardless of complexity; with it, spend tracks the actual mix of simple vs. complex traffic.
Every decision is recorded in a SHA-256 hash-chained log; any retroactive edit to an earlier entry is cryptographically detectable — built for compliance review.
Circuit-breaker pattern with automatic recovery isolates a failing dependency instead of cascading; Redis-backed distributed rate limiting supports both fail-open and fail-closed modes depending on your risk tolerance.
A real authenticated admin API (Bearer/API-key) drives policy hot-reload and multi-tenant isolation. Automated EU AI Act, NIST AI RMF, and OWASP LLM Top 10 compliance reporting is live-computed from real system state — circuit-breaker status, audit-chain integrity — not a static checklist.
The injection-detection numbers below come from a harder adversarial corpus after a real methodology fix — not reduced capability. Most vendors in this category don't publish anything this specific.
Free, open-source core. One-line integration — no infra to stand up.
Cost-aware routing plus the logging and controls auditors will eventually ask for.
Full audit trail, multi-tenant isolation, and argument-level controls tuned to your policy.
The inspection engine is open source — read the code, run it yourself, verify what it does.
Not a euphemism — this product has been through multiple rounds of internal security audits that found and fixed real bypasses before release, most recently 304 OSS / 407 enterprise tests passing with 0 failed.
Anyone claiming perfect detection is overclaiming. We publish what Sabrix AI Proxy catches, and keep hardening what it doesn't yet.
Full inspection engine, agentic tool-call governance, and credential/PII scrubbing. Self-hosted, MIT-licensed core.
Get the sourceTamper-evident audit log, multi-tenant isolation, and advanced classifier configuration for regulated deployments.
Talk to us