AegisGate Lens

Privacy-first prompt safety for AI tools. Detects PII, secrets, XSS, compliance, and adversarial prompts on-device. Apache 2.0.

Privacy-first browser extension that warns you in real time — before you hit send — when your AI prompt contains PII, secrets, source-code risks, compliance-relevant language, or adversarial prompt injections. AegisGate Lens runs 100% in your browser. It watches what you type into 10 of the top consumer AI chat tools, and shows a top-of-screen banner the moment sensitive content is detected. Your prompt never leaves your device. Regex detection runs in ~0.3ms. On-device ML detection adds ~5ms. No network calls. No remote inference. No prompt content logged anywhere. No accounts. No telemetry by default. WHAT IT CATCHES AegisGate Lens scans your prompt across five detection facets — four regex (synchronous, ~0.3ms) and one ML (asynchronous, ~5ms): • Personal data — government-issued IDs, contact information, financial account numbers, and biometric identifiers. Includes formats for the US, EU, UK, Canada, Australia, Brazil, and India, with structural validation (Luhn for cards, IBAN mod-97, BIP39 wordlist for seed phrases). 55 patterns. • Credentials and tokens — access keys for cloud infrastructure, source-control platforms, payment services, team-messaging tools, and email-delivery providers, plus OAuth and JWT tokens and PEM private keys. 41 patterns. • Source-code risks — script injection, event handler abuse, dangerous URL schemes, mutation XSS patterns, and SVG-based payloads. 12 patterns. • Compliance-relevant language — OWASP LLM Top 10, MITRE ATLAS adversary techniques, EU AI Act articles, and parallel frameworks for Brazil, the UK, and other jurisdictions. 43 patterns. • Adversarial prompt injections (NEW IN v0.3.0) — instruction override, roleplay injection, obfuscated commands, and other prompt injection attacks that regex cannot catch. Detected by an on-device Char CNN-BiLSTM neural network (1.58M parameters, pure JavaScript inference, no WASM, no remote server). 100% adversarial detection rate on v0.3.0 test set. Total: 151 regex patterns + 1 ML model. Defense in depth — regex catches structured patterns, ML catches semantic attacks. WHAT'S NEW IN v0.3.0 • ML threat detector — on-device Char CNN-BiLSTM with Attention catches adversarial prompt injections that regex misses. Pure JavaScript inference (~5ms in Chrome). No WASM, no onnxruntime, no external dependencies, no remote server. Lazy-loaded on first detection. • 6× smaller — extension reduced from 25MB to 4.2MB. Removed ONNX Runtime Web (18.4MB WASM binaries) and replaced with pure JS inference (488 lines). • Stricter CSP — script-src 'self' only. No wasm-unsafe-eval. No eval(). No Function(). No inline event handlers. • Lazy model loading — 3.7MB model weights load on first detection, not on page load. • 504 tests — 492 unit + 12 ML performance/stress tests. BENCHMARK RESULTS (v0.3.0, 2026-08-05) Tested against 6,500 real user prompts from the public WildChat corpus, a per-pattern corpus of 12,000+ synthetic records, and 10 adversarial prompt injection patterns: Regex detection: • False-positive rate: 2.31% (150 of 6,500 WildChat prompts flagged) • Latency p99: 0.14 ms on 500-character prompts (sub-millisecond) ML detection: • Adversarial detection rate: 100% (10/10 prompt injection patterns) • Benign pass-through rate: 81.8% (9/11 benign prompts passed; 2 false positives on creative writing) • Score separation: 0.82 (adversarial avg 0.988, benign avg 0.171) • Deterministic: 20/20 identical calls produce the exact same score • Latency: ~5ms in Chrome (pure JavaScript, no WASM) Test suite: • 492 Node unit tests passing • 12 ML performance/stress tests passing • All 10 providers regression-tested PRIVACY ARCHITECTURE (OUR DIFFERENTIATOR) We are the only AI security tool where the privacy guarantee is enforced by what we cannot do, not what we promise: • No server round-trip • No prompt content ever crosses a wire • No model upload, no inference API, no remote ML • No third-party SDK • No analytics SDK • No cookies • No fingerprinting • No A/B testing • No crash reporting • No remote config • No update checks beyond the standard Chrome update channel • No accounts, no sign-in, no email capture The ML model runs entirely in your browser. Weights are bundled in the extension (3.7MB). No download at runtime. No learning from user input. No model updates over the network. Cloud-based competitors all see your prompt content. We cannot, because we never receive it. For SOC 2, HIPAA, GDPR, and EU AI Act compliance, that architectural fact matters. Telemetry is opt-in (off by default), domain-hashed, and limited to non-content metadata: hashed domain, category, severity, and the action you took (cancel / redact / send / false-positive). The hashed domain is rotated periodically. HOW IT WORKS You type into a supported AI chat tool. After a 250ms debounce, the content script runs the four-facet regex detector (synchronous, ~0.3ms). Simultaneously, the ML detector runs asynchronously (~5ms). If a match fires, a brand-matched banner appears at the top of the page showing the category, severity, and a masked value. You choose: Cancel send / Edit & redact / Send anyway / This is a false positive. Nothing leaves your browser. HOW IT COMPARES AegisGate Lens vs. cloud-based competitors: • Pricing: Free, forever — no seat license, no enterprise tier • Architecture: 100% on-device, not a cloud-side service • Sees prompt content: Never, by architectural design • Latency: 0.3ms regex + 5ms ML (cloud alternatives add network round-trip latency) • Open source: Yes (Apache 2.0), threat model and architecture published • ML inference: On-device pure JavaScript, no WASM, no onnxruntime, no remote server • Privacy moat: Cannot see prompts, because we never receive them SECURITY POSTURE • Manifest V3, strict CSP (script-src 'self'; object-src 'self'), no eval(), no Function(), no wasm-unsafe-eval • Zero npm dependencies, zero WASM binaries, zero external runtime dependencies • Sender-id validation in the service worker — messages from foreign extensions are rejected • Domain hashing for any opt-in telemetry • ML model: bundled at build time, not downloadable at runtime, not updatable remotely • Lazy model loading: 3.7MB weights fetched only on first detection • SLSA L2 build provenance, Ed25519 commit signing • 504 automated tests PERMISSIONS (FULL TRANSPARENCY) The manifest requests exactly three permissions and one host permission: • storage — for the per-domain 24h dismissal map, the opt-in state, the FP-report queue, and the on-device event ring buffer. • scripting — for dynamic content-script injection into supported AI chat tabs via chrome.scripting.executeScript. Used as a fallback when static content_scripts.matches hasn't fired (Cloudflare interstitials, SPA sub-pages). No user data is read. All storage is local (chrome.storage.local + chrome.storage.session); no values ever cross a wire. • unlimitedStorage — quota flag; raises Chrome's default quota so the cap we enforce in code (MAX_EVENTS_RING: 1000, MAX_USER_ACTIONS: 100) is the one that matters. • host_permissions: https://lens.aegisgatesecurity.io/* — the opt-in FP-report backend endpoint. Network egress is opt-in only; by default the extension makes zero network calls. We do not request activeTab, <all_urls>, tabs, webRequest, webRequestBlocking, proxy, or debugger. ROADMAP • v0.4.0 — Firefox and Edge support; 7 vertical detection packs (Healthcare, Finance, Legal, EU AI Act, Manufacturing, Federal, Defense) as free in-Lens add-ons • v0.5.0 — Per-team dashboards via the AegisGate Platform, custom user patterns, detection history export LICENSE Apache 2.0. Copyright © 2024–2026 AegisGate Security, LLC. SUPPORT • Issues: https://github.com/aegisgatesecurity/aegisgate-lens/issues • Privacy policy: https://aegisgatesecurity.io/lens/privacy • Security policy: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/SECURITY.md • Threat model: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/docs/THREAT-MODEL.md • Marketing site: https://aegisgatesecurity.io/lens/