1

Prompt & content scanning

Every prompt, tool call result, and model output is scanned before it can route execution anywhere. Runs against deterministic rule sets in your process. Nothing leaves. Catches injection attempts before they reach anything that matters.

2

Runtime interception

Hooks into the Python runtime to intercept dangerous operations (code execution, network calls, file writes, subprocess spawning) at the moment they are attempted. No prompt obfuscation bypasses a hook on the operation itself. Works regardless of how the call was reached.

3

OS kernel backstop

A second, independent enforcement layer operating at the kernel level on Linux. Completely separate from the Python runtime. An exploit that disables the application-level layer still hits this one. Cannot be reversed from application code.

Measured against independent benchmarks.

Validated against independent, labelled datasets of jailbreak and prompt injection attempts. These results are for the content scanning layer only. Anything that evades it still gets blocked by runtime interception.

High recall
Catches explicit injection attempts in independent, labelled testing
Precise
When Thicket blocks, it’s almost always right
Low
False positive rate on clean traffic
Very low
Added latency per request

Thicket is an injection and execution detector, not a harmful content classifier. Benchmarks that test content moderation (jailbreak refusal, harmful output) measure a different problem. See our comparison page for context.

hello@hedgerow.dev