LlamaFirewall
Prompt-injection success rate: 17.6% without, 1.7% with
Latest: LlamaFirewall (2025), part of the PurpleLlama repository
An open-source, system-level guardrail framework for securing AI agents, released April-May 2025 and used in production at Meta. Its three layers — PromptGuard 2 (jailbreak detection), Agent Alignment Checks (a chain-of-thought auditor catching goal hijacking), and CodeShield (static analysis of generated code) — defend against prompt injection and insecure agent behavior.
Why it matters
A system-level guardrail framework for AI agents, used in production at Meta and released open source: PromptGuard 2 for jailbreak detection, Agent Alignment Checks that audit chain-of-thought for goal hijacking, and CodeShield static analysis of generated code. One of the first open, layered defenses built specifically for agent workflows.
Facts
- In Meta's AgentDojo evaluation, prompt-injection attacks succeeded 17.6% of the time without LlamaFirewall — and 1.7% with it, a >90% reduction.
- Any developer who can write a regex can add a custom scanner.
Try it yourself
pip install llamafirewall ↗ Documentation and tutorials ↗ Read the paper ↗
Lineage
Sources
GitHub · PurpleLlama ↗Meta AI research ↗meta-llama.github.io ↗