AegisGate Lens

Privacy-first prompt safety for AI tools. Detects PII, secrets, XSS, compliance, and adversarial prompts on-device. Apache 2.0.

Privacy-first browser extension that warns you in real time — before you hit send — when your AI prompt contains PII, secrets, source-code risks, compliance-relevant language, or adversarial prompt injections. AegisGate Lens runs 100% in your browser. It watches what you type into 10 of the top consumer AI chat tools, and shows a top-of-screen banner the moment sensitive content is detected. Your prompt never leaves your device. Regex detection runs in ~0.3ms. On-device ML detection adds ~5-50ms. No network calls. No remote inference. No prompt content logged anywhere. No accounts. No telemetry by default. PATENT PENDING — AegisGate's detection pipeline and response scanning technologies are patent pending with the USPTO (Provisional App. Nos. 64/153,576 and 64/153,577, filed September 12, 2026). WHAT IT CATCHES AegisGate Lens scans your prompt across five detection facets — four regex (synchronous, ~0.3ms) and one ML (asynchronous, ~5-50ms): • Personal data — government-issued IDs (US, EU, UK, Canada, Australia, Brazil, India), contact information, financial account numbers (credit cards with Luhn validation, IBAN with mod-97 validation, bank routing numbers), biometric identifiers, cryptocurrency wallet addresses, and BIP39 seed phrases. Brand-specific credit card patterns for Visa, Mastercard, Amex, Discover, and international cards. German Tax ID support added in v0.4.0. • Credentials and tokens — access keys for major cloud infrastructure, source-control, payment, messaging, and email-delivery platforms. OAuth tokens, JWT tokens, PEM private keys, and API key formats for 40+ services. • Source-code risks — script injection, event handler abuse, dangerous URL schemes, mutation XSS patterns, and SVG-based payloads. • Compliance-relevant language — OWASP LLM Top 10, MITRE ATLAS adversary techniques, EU AI Act articles, NIST AI RMF, ISO 42001, and parallel frameworks for Brazil, the UK, and other jurisdictions. Detection rules map to specific compliance controls, generating evidence-grade alerts. • Adversarial prompt injections — instruction override, roleplay injection, obfuscated commands, character substitution attacks, QWERTY keywalk evasion, and other prompt injection attacks that regex cannot catch. Detected by an on-device Char CNN-BiLSTM neural network with Attention (v11b, ~1.6M parameters, pure JavaScript inference, no WASM, no remote server). 99.8/100 evasion resistance across 2,600 adversarial test cases. Total: 176 regex patterns + 1 ML model. Defense in depth — regex catches structured patterns, ML catches semantic attacks. WHAT'S NEW IN v0.4.1 • v11b neural model — upgraded from v9 to v11b, matching the AegisGate Platform and Rampart. Improved adversarial detection with the same pure JavaScript inference (~5-50ms). Model weights are float16 gzip base64 JSON (3.75MB), lazy-loaded on first detection. • Latin-1 full encoding — the ML encoder now correctly handles characters 128-255 (previously truncated at 128). Full Latin-1 vocabulary (256 tokens) with 256-character input sequences. • keyWalkReverse evasion resistance — QWERTY keywalk inverse mapping ported from Platform and Rampart, enabling detection of character-substitution evasion techniques used to bypass regex patterns. • 550-test adversarial evasion suite — 50 evasion transforms x 11 MITRE ATLAS attack payloads validate detection resistance against character substitution, case manipulation, punctuation injection, encoding tricks, and other adversarial techniques. • SHA-256 model weight verification — the ML model is cryptographically verified via SHA-256 hash before loading, preventing supply-chain tampering that could silently bypass ML detection. • Firefox support — AegisGate Lens is now available on Mozilla Firefox (142+) in addition to Google Chrome (116+) and Microsoft Edge. • Zero external dependencies — no npm packages, no CDNs, no WASM binaries, no third-party SDKs. The entire extension is self-contained. • Security hardening — CODEOWNERS file, gitleaks secret scanning in CI, smoke tests on every push to main, strict CSP (script-src 'self' only). BENCHMARK RESULTS (v11b model, September 2026) The v11b CharCNN-BiLSTM model is trained on 70,572 samples and achieves: • Test accuracy: 98.27% • Test F1 score: 96.07% • Evasion resistance: 99.8/100 across 2,600 adversarial tests (52 ATLAS payloads x 50 transforms) • False positive rate: 0% calibrated (0.64% raw, 35 of 5,479 benign samples) • Inference latency: ~5-50ms in Chrome (pure JavaScript, no WASM), <1ms on server-side ONNX Runtime Lens-specific evasion suite: • 550 adversarial tests (50 transforms x 11 ATLAS payloads) • Detects instruction override, roleplay injection, obfuscated commands, and encoding-based evasion Regex detection: • 176 patterns across 4 facets (PII, credentials, source-code risks, compliance) • Latency p99: 0.14ms on 500-character prompts (sub-millisecond) • Structural validation: Luhn for credit cards, IBAN mod-97, BIP39 wordlist for seed phrases Test suite: • 257 automated tests passing • All 10 providers regression-tested • ML performance and stress tests included PRIVACY ARCHITECTURE (OUR DIFFERENTIATOR) We are the only AI security tool where the privacy guarantee is enforced by what we cannot do, not what we promise: • No server round-trip • No prompt content ever crosses a wire • No model upload, no inference API, no remote ML • No third-party SDK • No analytics SDK • No cookies • No fingerprinting • No A/B testing • No crash reporting • No remote config • No update checks beyond the standard browser update channel • No accounts, no sign-in, no email capture The ML model runs entirely in your browser. Weights are bundled in the extension (3.75MB). No download at runtime. No learning from user input. No model updates over the network. Cloud-based competitors all see your prompt content. We cannot, because we never receive it. For SOC 2, HIPAA, GDPR, and EU AI Act compliance, that architectural fact matters. Telemetry is opt-in (off by default), domain-hashed, and limited to non-content metadata: hashed domain, category, severity, and the action you took (cancel / redact / send / false-positive). The hashed domain is rotated periodically. HOW IT WORKS You type into a supported AI chat tool. After a 250ms debounce, the content script runs the four-facet regex detector (synchronous, ~0.3ms). Simultaneously, the ML detector runs asynchronously (~5-50ms). If a match fires, a brand-matched banner appears at the top of the page showing the category, severity, and a masked value. You choose: Cancel send / Edit and redact / Send anyway / This is a false positive. Nothing leaves your browser. HOW IT COMPARES AegisGate Lens vs. cloud-based competitors: • Pricing: Free, forever — no seat license, no enterprise tier • Architecture: 100% on-device, not a cloud-side service • Sees prompt content: Never, by architectural design • Latency: 0.3ms regex + 5-50ms ML (cloud alternatives add network round-trip latency) • Open source: Yes (Apache 2.0), threat model and architecture published • ML inference: On-device pure JavaScript, no WASM, no onnxruntime, no remote server • ML model: v11b CharCNN-BiLSTM with Attention, ~1.6M parameters, 98.27% accuracy, 99.8/100 evasion resistance • Privacy moat: Cannot see prompts, because we never receive them • Patent pending: USPTO Provisional App. Nos. 64/153,576 and 64/153,577 SECURITY POSTURE • Manifest V3, strict CSP (script-src 'self'; object-src 'self'), no eval(), no Function(), no wasm-unsafe-eval • Zero npm dependencies, zero WASM binaries, zero external runtime dependencies • SHA-256 model weight verification — ML model cryptographically verified before loading • Sender-id validation in the service worker — messages from foreign extensions are rejected • Domain hashing for any opt-in telemetry • ML model: bundled at build time, not downloadable at runtime, not updatable remotely • Lazy model loading: 3.75MB weights fetched only on first detection • Gitleaks secret scanning in CI, smoke tests on every push • 257 automated tests PERMISSIONS (FULL TRANSPARENCY) The manifest requests exactly three permissions and one host permission: • storage — for the per-domain 24h dismissal map, the opt-in state, the FP-report queue, and the on-device event ring buffer. • scripting — for dynamic content-script injection into supported AI chat tabs via chrome.scripting.executeScript. Used as a fallback when static content_scripts.matches has not fired (Cloudflare interstitials, SPA sub-pages). No user data is read. All storage is local; no values ever cross a wire. • unlimitedStorage — quota flag; raises the default quota so the cap we enforce in code is the one that matters. • host_permissions: https://lens.aegisgatesecurity.io/* — the opt-in FP-report backend endpoint. Network egress is opt-in only; by default the extension makes zero network calls. We do not request activeTab, <all_urls>, tabs, webRequest, webRequestBlocking, proxy, or debugger. ROADMAP • v0.5.0 — Per-team dashboards via the AegisGate Platform, custom user patterns, detection history export • v0.6.0 — Vertical detection packs (Healthcare, Finance, Legal, Federal) as free in-Lens add-ons LICENSE Apache 2.0. Model weights licensed under the AegisGate Model Weight License (non-commercial free, commercial requires license). Copyright 2024-2026 AegisGate Security, LLC. SUPPORT • Issues: https://github.com/aegisgatesecurity/aegisgate-lens/issues • Privacy policy: https://aegisgatesecurity.io/lens/privacy • Security policy: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/SECURITY.md • Threat model: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/docs/THREAT-MODEL.md • Marketing site: https://aegisgatesecurity.io/lens/