Each layer operates at a different point in the execution path. Evading one means you immediately face the next, with different bypass requirements at each level.
Every prompt, tool call result, and model output is scanned before it can route execution anywhere. Runs against deterministic rule sets in your process. Nothing leaves. Catches injection attempts before they reach anything that matters.
Hooks into the Python runtime to intercept dangerous operations (code execution, network calls, file writes, subprocess spawning) at the moment they are attempted. No prompt obfuscation bypasses a hook on the operation itself. Works regardless of how the call was reached.
A second, independent enforcement layer operating at the kernel level on Linux. Completely separate from the Python runtime. An exploit that disables the application-level layer still hits this one. Cannot be reversed from application code.
Detection performance
Validated against independent, labelled datasets of jailbreak and prompt injection attempts. These results are for the content scanning layer only. Anything that evades it still gets blocked by runtime interception.
Thicket is an injection and execution detector, not a harmful content classifier. Benchmarks that test content moderation (jailbreak refusal, harmful output) measure a different problem. See our comparison page for context.