Muhammad Hasnain

toolwall — a firewall for indirect prompt injection

Open source (Apache-2.0) · Python · 2026

AI agents read web pages, emails and tool outputs. Text hidden in that content can tell the agent to do something the user never asked for. toolwall checks every tool response before it reaches the model, using fast rules plus a small fine-tuned classifier (DeBERTa-v3).

Held-out test (never used for training)	Result
InjecAgent attacks with unseen tools and unseen attacker instructions (two settings)	190 / 190 blocked
Benign tool responses from the same templates	0 / 150 blocked
Workplace emails that contain requests (Enron)	0 / 296 blocked
Random Wikipedia pages	1 / 400 blocked
BIPIA, run once after the model was frozen	8 / 150 attacks caught

v0.1 looked strong on its own test set but blocked 98 % of ordinary Wikipedia pages on outside data. v0.2 retrains the classifier under a strict held-out protocol. The BIPIA row is the honest limit: attacks that change the answer, rather than override instructions, mostly get through. The technical report covers the protocol, five mistakes we found and fixed, and the next step: a classifier that also sees the user's task.

Code and full results

ToolFlint

1,268 tool pages · runs in the browser

Image, PDF, text and developer utilities that process files on the user's own device. No uploads, no sign-up.

Landlord Tax Lab

UK landlord tax calculators · 2026/27 rules

Rental-income tax, capital gains, stamp-duty surcharge and Making Tax Digital calculators. 402 clicks from Google Search and 69,651 search impressions in the 90 days to 16 October 2026.