Every AI agent that fetches web content is playing Russian roulette with prompt injection. I’ve been researching this problem since early March, and I think most people building autonomous agents (like OpenClaw instances) haven’t fully internalized how bad it is. When your AI agent fetches a web page, every piece of that content flows directly into the model’s context window, and attackers can embed instructions in that content. They use hidden HTML divs, zero-width Unicode characters, fake LLM delimiters, and social engineering disguised as helpful advice. The agent can’t tell the difference between your instructions and the attacker’s, because to the model, it’s all just text. If you want a concrete example of how this plays out in the real world, the Clinejection attack earlier this year compromised roughly 4,000 developer machines through a prompt injection embedded in a GitHub issue title, which eventually led to credential theft and a malicious package publish. The AI triage bot had tool access and processed untrusted input in the same context, which is exactly the mistake this project tries to prevent.
I spent weeks digging through the academic literature, evaluating existing tools, and testing real attack patterns before writing a single line of code. Google DeepMind’s CaMeL paper proposed a rigorous P-Agent/Q-Agent architecture that’s theoretically sound but practically unusable. Their reference implementation is an abandoned research artifact that Google explicitly says they won’t fix bugs on. Lasso Security’s MCP Gateway looked promising until I discovered their prompt injection detection requires a commercial API key. Simon Willison has been writing about the Dual LLM pattern for years, and he’s right about the core insight: you need to keep untrusted content away from your privileged tools. But nobody had shipped a production-ready MCP server that actually does this, so I figured I might as well start building one myself, even if it meant getting a lot of things wrong at first.
MCP-Airlock is an open source MCP server that extracts web content through a three-layer defense system, where each layer uses a fundamentally different detection approach. I didn’t plan it as three layers from the start. It evolved that way as I kept finding attack patterns that bypassed whatever I’d already built, and I think that iterative process is actually what makes the architecture sound. Let me walk through how that evolution happened.
The first thing I built was a deterministic seven-stage sanitization pipeline, which became Layer 1. It strips hidden HTML elements, invisible Unicode characters, encoded payloads, data exfiltration URLs, and fake LLM delimiters. Since there’s no LLM involved at this stage, the whole thing runs fast and doesn’t cost anything, and for the specific structural attacks I designed it to catch, I haven’t seen it produce a single false negative yet. If someone hides instructions in a display:none div or fragments keywords with zero-width characters, this layer catches it every time.
Then I added Meta’s Llama Prompt Guard 2 as Layer 2, a 22-million parameter classifier running locally via ONNX Runtime. I almost cut this layer entirely after initial testing showed it only caught attacks that Layer 1 already handles. But after I ran systematic threshold tuning against 50 samples, I found that Prompt Guard catches five attack categories that completely bypass Layer 1’s regex patterns, things like “forget your training,” “override safety protocols,” and roleplay-based jailbreaks that use imperative behavioral commands instead of the explicit override language that regex can match. The classifier runs in about 30-80 milliseconds on CPU and costs nothing, and I’m glad I didn’t rip it out when I was tempted to.
I thought I had a pretty decent setup with the first two layers, but then I started throwing some of the more subtle, social-engineering style attacks at it and realized that both a regex parser and a trained classifier are basically blind to someone writing a convincing-sounding paragraph that tricks the agent into exfiltrating data. That’s what led to Layer 3, a quarantined Gemini Flash-Lite instance that acts as a Q-Agent. I set it up so it has no tool access at all, and on top of that it has no memory, which means there are fewer ways for an attacker to actually hijack anything important. This layer catches attacks like DAN (“Do Anything Now”) persona assignment, where the injected text defines a new AI character that has no ethical restrictions and instructs the model to respond as that character instead of following its original instructions. It also catches fake state transitions claiming policies have already been updated, and the really subtle ones where social engineering is disguised as article content that frames data exfiltration as a helpful action. Prompt Guard 2 scores these below 0.05, and Layer 1 doesn’t see them at all.
MCP-Airlock ships with tools for both cautious and paranoid use cases. The safe_fetch and safe_read tools run Layer 1 only and reject content when injection is detected, which works well for trusted domains where you want speed. The quarantine_fetch and quarantine_read tools run all three layers and warn but proceed, passing only the Q-Agent’s sanitized extraction to your primary agent. There’s also quarantine_scan for pre-flight threat assessment without returning any content, and I recently added safe_search and quarantine_search tools that pipe web searches through the same three-layer defense.
Now, I’m pretty sure there are still holes in this approach, but I think it’s a meaningful step forward. If you’re running OpenClaw instances that make web requests, I’d strongly encourage you to route them through MCP-Airlock instead of letting your agents fetch web content directly. The interface is MCP only, and it’s designed to run in a separate container from your autonomous agent, which means the trust boundary is enforced at the container level, not just by hoping the model follows instructions. Even Layer 1 by itself strips a significant amount of attack surface, and the full three-layer pipeline is a much better position to be in than raw, unfiltered web content flowing straight into your agent’s context window. It’s a small configuration change that eliminates entire categories of prompt injection.
For security researchers, the project is AGPL-licensed and the code is on GitHub. It takes about two minutes to install via pip install mcp-airlock-crunchtools or podman run quay.io/crunchtools/mcp-airlock. If you find an attack pattern that gets past all three layers, file an issue. I want to know about it and I want to fix it.
Log in
