AegisGate Lens

Privacy-first prompt safety for AI tools. Detects PII, secrets, XSS, compliance, and adversarial prompts on-device. Apache 2.0.

Privacy-first browser extension that warns you in real time — before you hit send — when your AI prompt contains PII, secrets, source-code risks, compliance-relevant language, or adversarial prompt injections. AegisGate Lens runs 100% in your browser. It watches what you type into 10 of the top consumer AI chat tools, and shows a top-of-screen banner the moment sensitive content is detected. Your prompt never leaves your device. Regex detection runs in ~0.3ms. On-device ML detection adds ~5-50ms. No network calls. No remote inference. No prompt content logged anywhere. No accounts. No telemetry by default. PATENT PENDING — AegisGate's detection pipeline and response scanning technologies are patent pending with the USPTO (Provisional App. Nos. 64/153,573–64/153,577, filed September 12, 2026; and 64/174,824, filed October 12, 2026). WHAT IT CATCHES AegisGate Lens scans your prompt across six detection facets — five regex (synchronous, ~0.3ms) and one ML (asynchronous, ~5-50ms): • Personal data — government-issued IDs (US, EU, UK, Canada, Australia, Brazil, India), contact information, financial account numbers (credit cards with Luhn validation, IBAN with mod-97 validation, bank routing numbers), biometric identifiers, cryptocurrency wallet addresses, and BIP39 seed phrases. Brand-specific credit card patterns for Visa, Mastercard, Amex, Discover, and international cards. German Tax ID support. (77 patterns) • Credentials and tokens — access keys for major cloud infrastructure, source-control, payment, messaging, and email-delivery platforms. OAuth tokens, JWT tokens (including near-expiry detection), STS session tokens, PEM private keys, and API key formats for 40+ services. (57 patterns) • Source-code risks — script injection, event handler abuse, dangerous URL schemes, mutation XSS patterns, and SVG-based payloads. (12 patterns) • Compliance-relevant language — OWASP LLM Top 10, MITRE ATLAS adversary techniques, EU AI Act articles, NIST AI RMF, ISO 42001, and parallel frameworks for Brazil, the UK, and other jurisdictions. Detection rules map to specific compliance controls, generating evidence-grade alerts. Includes ARTEX framework detection and LiteLLM supply-chain attack patterns. (62 patterns) • OT/ICS protocol patterns — OPC UA, Modbus, DNP3, CIP, S7comm for industrial environments. (9 patterns) • Adversarial prompt injections — instruction override, roleplay injection, obfuscated commands, character substitution attacks, QWERTY keywalk evasion, and other prompt injection attacks that regex cannot catch. Detected by an on-device Char CNN-BiLSTM neural network (v15b, 1,596,034 parameters, pure JavaScript inference, no WASM, no remote server). 99.975% evasion resistance across 4,050 adversarial test cases. Total: 217 regex patterns + 1 ML model. Defense in depth — regex catches structured patterns, ML catches semantic attacks. WHAT'S NEW IN v0.5.3 • ML model v15b — upgraded from v13 to v15b. Retrained on the v13 corpus (70,572 samples) with 256-char Latin-1 input restored. FPR reduced to 0.49% (27 false positives out of 5,479 benign samples). Architecture: embedding 256→64, conv [3,5,7]×256, BiLSTM 128 hidden, attention, dense 64→1. 1,596,034 parameters. Float16 weights (3.8MB), lazy-loaded on first detection. SHA-256 verified before loading. • ARTEX framework detection — flags prompts matching AI Red Teaming EXploitation framework patterns used by Storm-0940 and other threat groups. • LiteLLM supply-chain attack detection — flags prompts referencing compromised LiteLLM infrastructure and lookalike repository names. • STS session token + JWT near-expiry detection — catches AWS STS session tokens and JWTs approaching expiration that may be leaked in prompts. • 8 new compliance patterns (54 → 62). Total patterns: 209 → 217. • Rampart Bridge — Lens can relay detected threat signals to AegisGate Rampart's local proxy for cross-layer correlation with network-layer detection. Air-gap compatible — no-op when Rampart endpoint is not configured. • IOC Pull — Lens can fetch indicators of compromise from AegisGate Platform's telemetry endpoint, enhancing on-device detection with fresh threat intelligence. Uses ETag caching to minimize bandwidth. Air-gap compatible — no-op when Platform endpoint is not configured. • 4,050-test adversarial evasion suite — 81 MITRE ATLAS payloads × 50 evasion transforms validate detection resistance against character substitution, case manipulation, punctuation injection, encoding tricks, and other adversarial techniques. 99.975% evasion resistance (single float16 quantization miss). • SHA-256 model weight verification — the ML model is cryptographically verified via SHA-256 hash before loading, preventing supply-chain tampering that could silently bypass ML detection. • Firefox support — AegisGate Lens is available on Mozilla Firefox (142+) in addition to Google Chrome (116+) and Microsoft Edge. • Zero external dependencies — no npm packages, no CDNs, no WASM binaries, no third-party SDKs. The entire extension is self-contained. • Security hardening — CODEOWNERS file, gitleaks secret scanning in CI, smoke tests on every push to main, strict CSP (script-src 'self' only). BENCHMARK RESULTS (v15b model, October 2026) The v15b CharCNN-BiLSTM model is trained on 70,572 samples and achieves: • Test accuracy: 98.16% • Test precision: 98.20% • Test recall (TPR): 93.48% • Test F1 score: 95.78% • False positive rate: 0.49% (27 FP out of 5,479 benign samples) • Evasion resistance: 99.975% across 4,050 adversarial tests (81 payloads × 50 transforms). The single miss is a float16 quantization artifact; Platform/Rampart float32 models achieve 100.0/100. • Inference latency: ~5-50ms in Chrome (pure JavaScript, no WASM), <1ms on server-side ONNX Runtime • Confusion matrix: TP=1476, FP=27, FN=103, TN=5452 Regex detection: • 217 patterns across 5 facets (PII, credentials, source-code risks, compliance, OT/ICS) • Latency p99: 0.14ms on 500-character prompts (sub-millisecond) • Structural validation: Luhn for credit cards, IBAN mod-97, BIP39 wordlist for seed phrases Test suite: • 561 automated tests passing (505 node unit + 25 E2E manifest + 12 ML perf/stress + 3 Go unit + 16 headless smoke) • All 10 providers regression-tested • ML performance and stress tests included PRIVACY ARCHITECTURE (OUR DIFFERENTIATOR) We are the only AI security tool where the privacy guarantee is enforced by what we cannot do, not what we promise: • No server round-trip • No prompt content ever crosses a wire • No model upload, no inference API, no remote ML • No third-party SDK • No analytics SDK • No cookies • No fingerprinting • No A/B testing • No crash reporting • No remote config • No update checks beyond the standard browser update channel • No accounts, no sign-in, no email capture The ML model runs entirely in your browser. Weights are bundled in the extension (3.8MB). No download at runtime. No learning from user input. No model updates over the network. Cloud-based competitors all see your prompt content. We cannot, because we never receive it. For SOC 2, HIPAA, GDPR, and EU AI Act compliance, that architectural fact matters. Telemetry is opt-in (off by default), domain-hashed, and limited to non-content metadata: hashed domain, category, severity, and the action you took (cancel / redact / send / false-positive). The hashed domain is rotated periodically. HOW IT WORKS You type into a supported AI chat tool. After a 250ms debounce, the content script runs the five-facet regex detector (synchronous, ~0.3ms). Simultaneously, the ML detector runs asynchronously (~5-50ms). If a match fires, a brand-matched banner appears at the top of the page showing the category, severity, and a masked value. You choose: Cancel send / Edit and redact / Send anyway / This is a false positive. Nothing leaves your browser. HOW IT COMPARES AegisGate Lens vs. cloud-based competitors: • Pricing: Free, forever — no seat license, no enterprise tier • Architecture: 100% on-device, not a cloud-side service • Sees prompt content: Never, by architectural design • Latency: 0.3ms regex + 5-50ms ML (cloud alternatives add network round-trip latency) • Open source: Yes (Apache 2.0), threat model and architecture published • ML inference: On-device pure JavaScript, no WASM, no onnxruntime, no remote server • ML model: v15b CharCNN-BiLSTM, 1,596,034 parameters, 98.16% accuracy, 99.975% evasion resistance • Privacy moat: Cannot see prompts, because we never receive them • Patent pending: USPTO Provisional App. Nos. 64/153,573–64/153,577 and 64/174,824 SECURITY POSTURE • Manifest V3, strict CSP (script-src 'self'; object-src 'self'), no eval(), no Function(), no wasm-unsafe-eval • Zero npm dependencies, zero WASM binaries, zero external runtime dependencies • SHA-256 model weight verification — ML model cryptographically verified before loading • Sender-id validation in the service worker — messages from foreign extensions are rejected • Domain hashing for any opt-in telemetry • ML model: bundled at build time, not downloadable at runtime, not updatable remotely • Lazy model loading: 3.8MB weights fetched only on first detection • Gitleaks secret scanning in CI, smoke tests on every push • 561 automated tests PERMISSIONS (FULL TRANSPARENCY) The manifest requests exactly three permissions and one host permission: • storage — for the per-domain 24h dismissal map, the opt-in state, the FP-report queue, and the on-device event ring buffer. • scripting — for dynamic content-script injection into supported AI chat tabs via chrome.scripting.executeScript. Used as a fallback when static content_scripts.matches has not fired (Cloudflare interstitials, SPA sub-pages). No user data is read. All storage is local; no values ever cross a wire. • unlimitedStorage — quota flag; raises the default quota so the cap we enforce in code is the one that matters. • host_permissions: https://lens.aegisgatesecurity.io/* — the opt-in FP-report backend endpoint. Network egress is opt-in only; by default the extension makes zero network calls. We do not request activeTab, <all_urls>, tabs, webRequest, webRequestBlocking, proxy, or debugger. ROADMAP • v0.6.0 — Vertical detection packs (Healthcare, Finance, Legal, Federal) as free in-Lens add-ons • Future — Per-team dashboards via the AegisGate Platform, custom user patterns, detection history export LICENSE Apache 2.0. Model weights licensed under the AegisGate Model Weight License (non-commercial free, commercial requires license). Copyright 2024-2026 AegisGate Security, LLC. SUPPORT • Issues: https://github.com/aegisgatesecurity/aegisgate-lens/issues • Privacy policy: https://aegisgatesecurity.io/lens/privacy • Security policy: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/SECURITY.md • Threat model: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/docs/THREAT-MODEL.md • Marketing site: https://aegisgatesecurity.io/lens