All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This analysis is scoped to LlamaFirewall.
LlamaFirewall is a free Python library from Meta for developers and security teams building LLM applications. It screens the prompts entering an application, the plans its agents make, and the code they generate. One of its checks, the Prompt Guard 2 classifier, flags prompts that try to bypass model safeguards. A paper accepted to USENIX Security 2026 calls its performance on disguised prompts a severe regression. Its detection scores on those prompts ran from 0.02 to 0.23, below the version it replaced. A second paper tested six systems including Prompt Guard from Meta and saw evasion reach 100 percent in some cases. The licence is royalty-free for eligible users, and the code is public. On the published evidence the classifier is one layer of defense rather than a dependable gate.
| Description | LlamaFirewall is an open-source guardrail framework from Meta that detects security risks in LLM chat and multi-step AI agents, with scanners for prompt injection, agent misalignment, and insecure generated code. | [f1] |
|---|---|---|
| Deployment | Self-hosted | [f2] |
| Product | What it does |
|---|---|
| LlamaFirewall | LlamaFirewall: Open-source guardrail framework from Meta that scans LLM apps and agents with PromptGuard 2, AlignmentCheck, and CodeShield scanners. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
LlamaFirewall is an open-source guardrail framework from Meta that scans LLM apps and agents with the PromptGuard 2, AlignmentCheck, and CodeShield scanners. It is mapped to the AI Defense Matrix. [f3]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | The Meta-authored paper names the buyer, teams building agents that act on untrusted webpages and emails, and the pain, prompt injection, agent misalignment, and insecure generated code. Two independent research groups have since published attacks on this class of defense, which corroborates that the problem is live but measures guardrail evasion rather than how widely buyers meet it. [s3, s2, s10, s12] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | The README documents a policy engine composing a BERT-style injection classifier, a chain-of-thought auditor, a Semgrep-based code analyzer, and regex filters, and both the implementing code and the detector weights are open to inspection. Independent scrutiny is multiply evidenced and mixed: a paper accepted to USENIX Security 2026 evaluates the classifier among 14 open-weight guards and records detection scores of 0.02 to 0.23 on disguised prompts. [s2, s6, s10, s11] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | The paper Meta submitted on 6 May 2025 dates the enabler, describing language models moving from chatbots into agents that edit production code and act on untrusted inputs. The record carries one kind of signal, the May 2025 release and the press coverage of it, which is indirect rather than the several distinct kinds of buyer demand a higher score asks for, and it documents no purchasing behavior. [s3, s7] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | The paper lists 19 named authors, and the same repository holds four Llama Guard generations, two Prompt Guard generations, and the CyberSecEval benchmarks, a sustained public record in AI security rather than a single release. The Prompt Guard 2 model card documents a second detector generation with expanded training datasets and a refined objective function. [s3, s1, s6] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 2/5 | The traction evidence for the library itself is anonymous download activity, 4,725 downloads of the package in the last month recorded by PyPI Stats. No named reference customer, design partner, or paid partnership appears in the reviewed record, which places the line in the unnamed-adopter band rather than the named-reference band. [s13, s6, s1] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 2/5 | LlamaFirewall is a shipped and distributed product with measurable output, a published package downloaded 4,725 times in the last month, which keeps it clear of the absent-or-contradicted floor. Capital input stays unverifiable, because no budget, revenue, or separable funding line for the product appears in the reviewed record, and the packaged release has not moved past 1.0.3 of 29 May 2025, so the visible shipping that carries the middle rung has thinned. [s5, s9, s13] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | Third-party researchers place the product in a recognizable class, evaluating Meta's detector beside Microsoft's Azure Prompt Shield in one paper and among 14 open-weight guards in another, and the AI Defense Matrix Catalog lists it as a self-hosted guardrail. That placement comes from research and a catalog rather than from buyers or analysts, so the category reads as forming rather than established. [s12, s11, s8] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 2/5 | NVIDIA publishes an Apache-2.0 guardrail toolkit doing the same job, so a platform vendor shipping the capability natively is a plausible release rather than a distant one, and the licence on Meta's detector weights expressly permits derivative works, which lowers the cost of copying this implementation. [s15, s6, s16] |
LlamaFirewall targets the security gap that opened when language models began acting as agents. The paper Meta submitted on 6 May 2025 describes agents that edit production code, orchestrate workflows, and take higher-stakes actions on untrusted inputs such as webpages and emails. It argues that model fine-tuning and chatbot guardrails do not fully address the resulting risks.
The buyer is the team building those agents. The pain named in the record is prompt injection, agent misalignment, and insecure generated code, and the framing is a real-time final layer rather than a training-time fix.
Two independent research groups have since published attacks on this class of defense, one accepted to USENIX Security 2026 and one for LLMSec 2025. Both papers show attackers defeating guards of this kind, which corroborates that the problem is live. That work measures how well guards hold up rather than how many buyers meet the problem, so the reviewed record does not quantify the pain. [s3, s2, s10, s12]
LlamaFirewall is a policy engine that composes scanners rather than a single model. The README describes PromptGuardScanner, AlignmentCheckScanner, CodeShieldScanner, and customizable regex filters running across the agent's lifecycle.
Each scanner does a different job. Prompt Guard 2 is a lightweight BERT-style classifier for direct prompt injection. AlignmentCheck audits an LLM agent's reasoning in real time and is described as experimental in both the paper and the press coverage. CodeShield applies Semgrep and regex-based rules to generated code across eight programming languages.
The implementation is open to inspection, which is what separates these descriptions from a marketing claim. The package installs from PyPI, the detector weights download from Hugging Face, and outside researchers have run the classifier in published evaluations. [s2, s3, s7, s11]
LlamaFirewall competes for developer attention rather than budget. NVIDIA publishes NeMo Guardrails under the Apache License, Version 2.0, and Guardrails AI publishes a Python framework under Apache-2.0, so a developer shopping for a free guardrail has more than one.
Commercial vendors sell against the same risks. Lakera's site lists prompt injection attacks among the risks it manages and carries a Check Point Software Technologies copyright notice. NeuralTrust presents itself as a platform for AI and agent security.
The reviewed surfaces show no Meta price and no sales contact for LlamaFirewall. They document no hosted service from Meta either, so the question a buyer weighs is maintenance and trust rather than cost. [s15, s16, s14, s17]
The distribution channels documented in the reviewed record are GitHub, PyPI, and Hugging Face. The library installs from PyPI, and the README says the package downloads any missing detector model from Hugging Face automatically.
Uptake shows up as download counts rather than names. PyPI Stats records 4,725 downloads of the package in the last month and 1,510 in the last week. The Prompt Guard 2 model card records 129,859 downloads in the last month and 10 published finetunes, though that model runs on its own as well as inside LlamaFirewall. No named reference customer or paid partnership appears in the reviewed record.
Shipping has thinned since the launch year. The most recent packaged release is 1.0.3, uploaded on 29 May 2025, and the 2026 commits visible on the directory's history are largely maintenance, such as dependency updates, lint cleanups, and test fixes. [s13, s6, s5, s9]
LlamaFirewall is published under Meta's PurpleLlama project, which the repository describes as tools to assess and improve LLM security. The paper lists 19 named authors, and the work sits in the PurpleLlama line alongside Llama Guard and the CyberSecEval benchmarks.
That is a sustained public record rather than a single release. The repository lists directories for four Llama Guard generations and two Prompt Guard generations. The Prompt Guard 2 model card documents the second of those, built on expanded training datasets and a refined objective function that reduces false positives on unfamiliar data.
The same depth that produced the scanners also produced the benchmarks that document them, which is the credibility a developer weighs when deciding whether to run someone else's security code. [s3, s1, s6]
Transparency is what LlamaFirewall offers in place of a vendor commitment. The code is open on GitHub, the design and benchmarks are in a published paper, and the README presents auditability and community extension as design goals.
What the reviewed record does not document is any commercial assurance. It shows no support contract, no service-level commitment, and no hosted endpoint from Meta, so a team running the library in production owns its uptime, tuning, and upgrades.
Self-hosting is also not complete. The AlignmentCheck scanner requires a configured Together API key, so the component that audits agent reasoning depends on an outside service the adopter has to arrange. [s2, s3, s8]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Lakera | competes with | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. | |
| Guardrails AI | competes with | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| NeuralTrust | competes with | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| Protect AI | competes with | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| NVIDIA NeMo Guardrails | competes with |
Add analyzed competitors to compare them side by side with Meta.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
The hard part of LlamaFirewall is the detector engineering, and Meta publishes the result. The jailbreak classifier ships as downloadable weights and the library as open source, so a rival can run both without building either. What Meta keeps is what produced that release. Its model card names its own synthetic attack data and a private evaluation benchmark, and publishes neither. The corpus is an accumulated asset, and the reviewed record attaches no revenue to what it produces. Little else holds a customer in place. No contract or certification stands in the way, and leaving costs an adopter the work of rewiring a replacement into its own code. The published detectors are what a buyer gets, and the material behind them stays inside Meta.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Adopters receive scanning software they install and run themselves, a set of detectors composed by role inside their own application code. The reviewed record documents no service and no accountability commitment from Meta, so the adopting team operates the product and owns the outcomes. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | The README documents integration work beyond a bare import, such as scanners composed by role in application code, shipped integrations for the OpenAI Agents SDK and for LangChain, and a configured Together API key for AlignmentCheck. Leaving means rewiring those call sites into a replacement, and the cited record does not size that migration, so the friction sits at the middle rung. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | The reviewed product record identifies no certification, authorization, or regulatory requirement tied to LlamaFirewall. A funded competitor could meet whatever requirements an adopter faces through ordinary enterprise preparation, so nothing in the record slows a buyer who wants to swap the library out. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Building a multilingual injection classifier with a refined objective function and an adversarially hardened tokenizer, a chain-of-thought auditor, and a Semgrep-based analyzer that runs inline is machine learning and real-time systems work. Independent measurement puts classification at 19 to 92 milliseconds per prompt, which is the latency budget that makes the engineering hard. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | The record shows developers inside organizations building LLM applications adopting a free package directly, with no named enterprise reference and no procurement contact. Nothing in the reviewed record puts procurement or legal between Meta and a replacement, which holds the buyer class below the regulated-enterprise rung. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | The record documents LlamaFirewall as a library an application calls inline, a composable policy engine rather than an end-user application. It is not documented as a substrate other software runs on, so it stops short of infrastructure that applications depend on. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | The model card names retained material Meta does not publish, its own synthetic injections and data from red-teaming earlier Prompt Guard versions, alongside a private evaluation benchmark built with datasets distinct from the training data. That accumulated advantage is evidenced rather than inferred, while the rest of the training mix is open-source data and the finished weights and method are published, which leaves it replicable with time and effort rather than a moat. |
LlamaFirewall targets developers and security teams building LLM applications and AI agents. The README frames it as protection across the agent's lifecycle, and the AI Defense Matrix Catalog records the deployment as self-hosted, so the adopter runs it.
Because the product is free, the reviewed record shows no segmentation by deal size, geography, or industry. The split that does show up is by role. Agent developers want the prompt-injection and misalignment checks, and coding-agent teams want the CodeShield static analysis layer.
Reach is measured in downloads rather than accounts. PyPI Stats records 4,725 package downloads in the last month, and the Prompt Guard 2 model card records 129,859 downloads of the classifier in the same period.
LlamaFirewall is a policy engine that orchestrates scanners. The paper names three, a universal jailbreak detector, a chain-of-thought auditor the paper itself calls experimental, and an online static analysis engine for generated code. The README adds customizable regex filters as a fourth layer.
The detector models are Meta's own work, and Meta publishes them. Eligible licensees can download the Prompt Guard 2 weights from Hugging Face under a royalty-free limited licence, and the package downloads any missing model automatically. The licence carries attribution and acceptable-use conditions, and an organization above 700 million monthly active users has to request a separate licence from Meta.
Independent testing has since qualified how well the jailbreak classifier holds up. A paper accepted to USENIX Security 2026 evaluated 14 open-weight prompt guard models on 4,000 attack prompts, and reports Prompt Guard 2 showing severe regression on encoding and controlled-release attacks, with detection scores of 0.02 to 0.23 set against improved benchmark scores. A separate paper for LLMSec 2025 tested six protection systems including Prompt Guard from Meta and reports evasion success reaching 100 percent in some instances.
The go-to-market is open-source distribution rather than selling. LlamaFirewall lives in the PurpleLlama repository and installs from PyPI, so a developer can adopt it without a sales conversation.
Adoption is not contract-free. Downloading the detector weights means accepting the Llama community licence, which carries attribution and acceptable-use conditions, and an organization above 700 million monthly active users must request a separate licence from Meta.
The cited surfaces show no enterprise references and no sales motion, which fits a free research release. What can be counted is downloads rather than pipeline, and PyPI Stats puts package downloads at 4,725 in the last month and 1,510 in the last week.
There is no price. LlamaFirewall is free and open source, the catalog lists the deployment as self-hosted, and the README presents transparency and community collaboration as design goals.
Free is not the same as costless. An adopter carries the compute to run the scanners and the engineering to integrate them, and the AlignmentCheck scanner requires a configured Together API key, so one scanner depends on an outside service the adopter has to arrange.
The licence terms qualify the free label. The grant is royalty-free and limited, it carries attribution and acceptable-use conditions, and an organization above 700 million monthly active users must request a separate licence from Meta on terms the page does not state.
Delivery is a self-hosted Python library. The adopter installs the package, composes the scanners it wants by role, and calls the firewall inline, with the documentation site emphasizing minimal computational overhead.
The operational burden sits with the adopter. The reviewed repository, documentation, PyPI metadata, and catalog identify no Meta-hosted endpoint, paid support offer, or service-level commitment, so a team running LlamaFirewall in production owns its uptime, tuning, and upgrades.
Upstream work has narrowed. The most recent packaged release is 1.0.3 from 29 May 2025, and the 2026 commits visible on the directory's history are largely maintenance, such as dependency updates, lint cleanups, and test fixes, so a team adopting it should plan to carry fixes itself.
LlamaFirewall offers transparency in place of a commitment. The code is open on GitHub, the design and benchmarks sit in a published paper, and the README presents auditability and community extension as design goals.
What the reviewed record does not document is any commercial assurance. It shows no service-level commitment and no support contract, and both the paper and the press coverage flag AlignmentCheck as experimental, so a security team can verify the code and still carry the operational risk itself.
Outside testing adds a second thing to weigh. Two independent papers, one accepted to USENIX Security 2026 and one for LLMSec 2025, report evasions of prompt guard classifiers including Meta's, so a team relying on it should treat a clean verdict as weak evidence rather than a clearance.
LlamaFirewall is one piece of Meta's PurpleLlama line, which also holds four Llama Guard generations and the CyberSecEval benchmarks. The repository describes the line as tools to assess and improve LLM security.
The scanners plug into other people's stacks as well. The README ships worked integrations for the OpenAI Agents SDK and for LangChain, and the detector models sit on Hugging Face, where the model card records three adapters and 10 finetunes built on the 86M classifier.
The reviewed record attaches no revenue and no hosted service to LlamaFirewall, so what Meta earns from publishing it is not documented either. What the record does show is a safety layer an eligible developer can adopt without a licence fee.
The work is published under Meta's PurpleLlama line. The paper lists 19 named authors, and the same line produced Llama Guard and CyberSecEval.
The paper reports state-of-the-art performance for PromptGuard 2, calls AlignmentCheck experimental, and describes CodeShield as fast and extensible, so the strongest performance claim covers one scanner rather than all three.
The reviewed record identifies no dedicated sales or support organization for LlamaFirewall. Continued development therefore depends on Meta maintaining the project, the reviewed record identifies no customer-funded sales or support motion, and the packaged release history has been static since May 2025.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Meta: LlamaFirewall on GitHub (PurpleLlama) | official | 2026-08-27 |
| f2 | AI Defense Matrix Catalog entry | other | 2026-06-10 |
| f3 | AI Defense Matrix Catalog mapping | other | 2026-08-27 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | GitHub: meta-llama/PurpleLlama repository “Set of tools to assess and improve LLM security.” | official | 2026-08-27 |
| s2 | GitHub: LlamaFirewall README in the PurpleLlama repository “LlamaFirewall is a framework designed to detect and mitigate AI centric security risks, supporting multiple layers of inputs and outputs, such as typical LLM chat and more advanced multi-step agentic operations.” | official | 2026-08-27 |
| s3 | arXiv: LlamaFirewall, an open source guardrail system for building secure AI agents (abstract page) “Large language models (LLMs) have evolved from simple chatbots into autonomous agents capable of performing complex tasks such as editing production code, orchestrating workflows, and taking higher-stakes actions based on untrusted inputs like webpages and emails.” | research | 2026-08-27 |
| s4 | Meta: LlamaFirewall documentation site “Optimized for minimal computational overhead, ensuring negligible impact on performance and user experience.” | official | 2026-08-27 |
| s5 | PyPI: llamafirewall package JSON metadata “LlamaFirewall is a framework designed to detect and mitigate AI centric security risks, supporting multiple layers of inputs and outputs, such as typical LLM chat and more advanced multi-step agentic operations.” | official | 2026-08-27 |
| s6 | Hugging Face: Meta Llama Prompt Guard 2 86M model card “Both Llama Prompt Guard 2 models detect both prompt injection and jailbreaking attacks, trained on a large corpus of known vulnerabilities.” | official | 2026-08-27 |
| s7 | InfoQ: Meta Open Sources LlamaFirewall for AI Agent Combined Protection “LlamaFirewall is a real-time guardrail monitor designed to serve as a final layer of defense against security risks associated with AI Agents.” | press | 2026-08-27 |
| s8 | AI Defense Matrix Catalog: LlamaFirewall product page “Open-source guardrail framework from Meta that scans LLM apps and agents with PromptGuard 2, AlignmentCheck, and CodeShield scanners.” | other | 2026-08-27 |
| s9 | GitHub: commit history for the LlamaFirewall directory of PurpleLlama “Commits on Aug 18, 2026 Remove unused type error suppressions” | official | 2026-08-27 |
| s10 | arXiv: Bypassing Prompt Guards in Production with Controlled-Release Prompting (abstract page) “Finally, we provide a systematic evaluation of 14 open-weight prompt guard models, revealing that even reasoning-capable filters cannot reliably detect our attack without incurring prohibitive resource overhead.” | research | 2026-08-27 |
| s11 | arXiv: Bypassing Prompt Guards in Production with Controlled-Release Prompting (full text) “Llama Prompt Guard 2 shows severe regression on encoding and controlled-release attacks (detection 0.02-0.23) compared to its predecessor, despite improved benchmarks.” | research | 2026-08-27 |
| s12 | arXiv: Bypassing LLM Guardrails, an empirical analysis of evasion attacks (abstract page) “Through testing against six prominent protection systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard, we show that both methods can be used to evade detection while maintaining adversarial utility achieving in some instances up to 100% evasion success.” | research | 2026-08-27 |
| s13 | PyPI Stats: download statistics for the llamafirewall package “Downloads last month: 4,725” | other | 2026-08-27 |
| s14 | Lakera: company site “RISKS WE MANAGE Prompt Injection Attacks” | official | 2026-08-27 |
| s15 | GitHub: NVIDIA-NeMo/Guardrails repository “NVIDIA NeMo Guardrails library is an open-source toolkit for easily adding programmable guardrails to LLM-based conversational applications.” | official | 2026-08-27 |
| s16 | GitHub: guardrails-ai/guardrails repository “Guardrails is a Python framework that helps build reliable AI applications by performing two key functions:” | official | 2026-08-27 |
| s17 | NeuralTrust: company site “NeuralTrust | The Platform for AI and Agent Security” | official | 2026-08-27 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | GitHub: meta-llama/PurpleLlama repository “Set of tools to assess and improve LLM security.” | official | 2026-08-27 |
| s2 | GitHub: LlamaFirewall README in the PurpleLlama repository “LlamaFirewall is a framework designed to detect and mitigate AI centric security risks, supporting multiple layers of inputs and outputs, such as typical LLM chat and more advanced multi-step agentic operations.” | official | 2026-08-27 |
| s3 | arXiv: LlamaFirewall, an open source guardrail system for building secure AI agents (abstract page) “Large language models (LLMs) have evolved from simple chatbots into autonomous agents capable of performing complex tasks such as editing production code, orchestrating workflows, and taking higher-stakes actions based on untrusted inputs like webpages and emails.” | research | 2026-08-27 |
| s4 | Meta: LlamaFirewall documentation site “Optimized for minimal computational overhead, ensuring negligible impact on performance and user experience.” | official | 2026-08-27 |
| s5 | PyPI: llamafirewall package JSON metadata “LlamaFirewall is a framework designed to detect and mitigate AI centric security risks, supporting multiple layers of inputs and outputs, such as typical LLM chat and more advanced multi-step agentic operations.” | official | 2026-08-27 |
| s6 | Hugging Face: Meta Llama Prompt Guard 2 86M model card “Both Llama Prompt Guard 2 models detect both prompt injection and jailbreaking attacks, trained on a large corpus of known vulnerabilities.” | official | 2026-08-27 |
| s7 | InfoQ: Meta Open Sources LlamaFirewall for AI Agent Combined Protection “LlamaFirewall is a real-time guardrail monitor designed to serve as a final layer of defense against security risks associated with AI Agents.” | press | 2026-08-27 |
| s8 | AI Defense Matrix Catalog: LlamaFirewall product page “Open-source guardrail framework from Meta that scans LLM apps and agents with PromptGuard 2, AlignmentCheck, and CodeShield scanners.” | other | 2026-08-27 |
| s9 | GitHub: commit history for the LlamaFirewall directory of PurpleLlama “Commits on Aug 18, 2026 Remove unused type error suppressions” | official | 2026-08-27 |
| s10 | arXiv: Bypassing Prompt Guards in Production with Controlled-Release Prompting (abstract page) “Finally, we provide a systematic evaluation of 14 open-weight prompt guard models, revealing that even reasoning-capable filters cannot reliably detect our attack without incurring prohibitive resource overhead.” | research | 2026-08-27 |
| s11 | arXiv: Bypassing Prompt Guards in Production with Controlled-Release Prompting (full text) “Llama Prompt Guard 2 shows severe regression on encoding and controlled-release attacks (detection 0.02-0.23) compared to its predecessor, despite improved benchmarks.” | research | 2026-08-27 |
| s12 | arXiv: Bypassing LLM Guardrails, an empirical analysis of evasion attacks (abstract page) “Through testing against six prominent protection systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard, we show that both methods can be used to evade detection while maintaining adversarial utility achieving in some instances up to 100% evasion success.” | research | 2026-08-27 |
| s13 | PyPI Stats: download statistics for the llamafirewall package “Downloads last month: 4,725” | other | 2026-08-27 |
| s14 | Lakera: company site “RISKS WE MANAGE Prompt Injection Attacks” | official | 2026-08-27 |
| s15 | GitHub: NVIDIA-NeMo/Guardrails repository “NVIDIA NeMo Guardrails library is an open-source toolkit for easily adding programmable guardrails to LLM-based conversational applications.” | official | 2026-08-27 |
| s16 | GitHub: guardrails-ai/guardrails repository “Guardrails is a Python framework that helps build reliable AI applications by performing two key functions:” | official | 2026-08-27 |
| s17 | NeuralTrust: company site “NeuralTrust | The Platform for AI and Agent Security” | official | 2026-08-27 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.