Prompt injection
We assume prompt injection. Then we contain it.
Logs, tickets and alerts are attacker-influenceable text, and any LLM that reads them can be steered by them. We do not claim to prevent that. We build so that a steered model cannot do anything your side has not already allowed.
Model output is data, not commands
From the moment the model produces anything, it is treated as untrusted data, not as instructions to follow. A suggestion is quarantined and carried as structured evidence and a proposal. It has no channel of its own to reach a system; the only path to execution runs through controls you own.
Four things stand between a poisoned suggestion and your systems
- A policy gate evaluates every proposal against rules you define, before a human ever sees it.
- Human approval is required in v1 for every change; nothing executes on the model's say-so.
- A local allowlist on your gateway re-validates every job and refuses anything off-list, even a signed one.
- A deterministic executor runs allowlisted operations only, never a free-form command the model wrote.
Contain, not prevent
We are deliberate about the word. Preventing injection outright is not a promise anyone can keep against attacker-controlled input, so we do not make it. We contain the consequences instead: the worst a successful injection can ask for is something your allowlist already permits and your engineer already approved. That is a bound you can reason about.
Security findings never auto-remediate
The strongest containment is the path we refuse to build. Security findings are never auto-remediated, because acting automatically on attacker-influenceable signals destroys forensic evidence and can be triggered on purpose. They route to a human-driven, evidence-preserving lane instead.
See also: Security · What is an AI SRE
Run it against your real incidents, as a design partner
Vesmona is in private beta. We're looking for a small group of teams who'll run the platform on real incidents and tell us where it falls short. You get early access, a direct line to the engineering team, and a real say in the roadmap. We get the operational reality (and, where it's earned, the reference) that makes a platform product-ready.
Become a design partner