Runtime protection

Your AI application can be tricked into running code. Thicket stops it.

A prompt injection attack doesn’t need the LLM to say anything bad. It just needs the LLM to call the right function. Thicket sits between your application and the operations it can perform and blocks them before they execute: at the subprocess, the network socket, the file write. By the time it blocks, the operation hasn’t happened yet.

No AI Inside Every block traces to a deterministic rule or a kernel control, not a model score. Auditable. Explainable.

No external API Runs entirely in-process. No outbound calls, no latency overhead, no data leaving your environment.

Precision over noise When Thicket blocks, it’s almost always right. Tuned for a low false-positive rate on clean traffic, validated against a balanced, provenance-locked holdout across multiple attack categories.

See it block real attacks How it works →

What Thicket blocks

The attacks your existing tools can’t see.

Enforcing at the prompt level is the wrong layer. Base64-encode the payload, translate it, split it across tokens: none of it matters. Thicket enforces at the operation. There is no obfuscation that bypasses a kernel control.

Prompt injection

Every prompt, tool result, and model output is scanned before it can route execution anywhere. A library of deterministic patterns catches direct overrides, persona injections, and jailbreak templates. Runs in your process. Nothing leaves.

Cross-turn & multi-step attacks

Detects Crescendo-style escalation attacks, adversarial instructions accumulated across conversation turns, and sequential system prompt extraction — patterns invisible to single-message scanners.

Code execution via LLM output

exec, eval, subprocess.run: intercepted at the Python level before they run. Doesn’t matter what call path got there.

SSRF & network abuse

Blocks outbound connections to private IP ranges and cloud metadata endpoints. Enforced at the network call, not the prompt.

File system abuse

Sandboxes write access to sensitive paths (credentials, SSH keys, cloud config) so a compromised agent can’t exfiltrate them.

Model supply chain

Scans model checkpoint files for embedded payloads before they are loaded, stopping the attack before the Python runtime sees it.

OS kernel backstop

A second, independent enforcement layer at the kernel level. Cannot be reversed from application code. Catches bypasses that evade the Python layer.

Deployment

One library. Drop-in for the frameworks you already use.

Thicket installs as a standard Python package. thicket.init() auto-detects FastAPI, Flask, or Django and wires middleware automatically. Also patches LangChain, LlamaIndex, and OpenAI SDK. Run in audit_only mode to validate false positive rates before switching to enforcement.

Works with

LangChain · LlamaIndex · AutoGPT
FastAPI · Flask · Django
Kubernetes · Linux · Windows Server

Integrates with

Splunk · Elastic · Azure Monitor
GitHub Advanced Security
OCSF-structured audit logs

How it works → Compare to alternatives