Protection
Nine ways AI agents get attacked.
Every attack on an AI agent breaks one of nine things. ZeravaTech stands between your agent and the attacker: before the agent reads, before it acts, and before its answer leaves. Three protections are ready today, five are in early access, and the ninth, attacks carried in images, audio and video, is in construction. Each one below is marked, so you always know exactly what you have.
Basic: free
No trial period. No credit card.Hidden and encoded text
Instructions disguised in Base64, ciphers, look-alike letters, invisible characters, or tucked inside JSON and Markdown. We decode, normalize and unwrap them before your agent reads a word. Dozens of known disguises, undone.
Forged roles
Text that pretends to be the system or the assistant, and injected control tokens. Stripped on arrival, so only your system speaks as the system.
Full protection
Ready or in early access, each marked.Tampered models
Check a model before you deploy it. Is it the model you think it is, and can it still say no under pressure?
Calm requests
The most dangerous request is polite. We read what is being asked, not how nicely: an irreversible action that touches many people is treated as high-stakes, however calm the sentence. We read your agent’s reply as well, to catch the moment it simply obeys.
Dangerous content
Requests for material that harms people outside the conversation. Answers are checked one by one and as a whole, so a request split across ten innocent questions is still read as one.
Control over the reply
Attempts to dictate how your model must begin, format or reason, or to flood your system prompt out of the conversation. Our guard assembles every call itself. Your system prompt is always there, and the model can always refuse.
Tool-call manipulation
Harm hidden in a tool’s arguments, or in which tool gets chosen. Text from outside never reaches an irreversible action. A tool that quietly changes is refused until you approve it again. A new tool earns trust before it acts alone.
Attacks through your application
Model output that turns against the app around it, or leaks between customers. Every place your output goes is checked on its own terms, links included, and your secrets are counted on the way out, even when they leave in pieces.
In the full plan: irreversible actions from an unknown source wait for a human. Repeated attempts are counted by who asks, by what they say and by what they aim at. A refusal never tells the attacker which rule stopped them.
In construction
Not available yet.Attacks hidden in images, audio and video
Payloads carried in pictures, sound and video instead of text. We are building this now. Until it ships, text is where we protect you.
Mapped to the OWASP Top 10 for LLM Applications
Each attack beside the OWASP Top 10 for LLM Applications (2025) entries it falls under, so you can line our coverage up with your own risk register.
| # | Attack | Status | OWASP LLM Top 10 |
|---|---|---|---|
| 01 | Hidden and encoded text | Ready | LLM01 Prompt Injection |
| 02 | Forged roles | Ready | LLM01 Prompt Injection |
| 03 | Tampered models | Ready | LLM03 Supply ChainLLM04 Data and Model Poisoning |
| 04 | Calm requests | Early access | LLM01 Prompt InjectionLLM06 Excessive Agency |
| 05 | Dangerous content | Early access | LLM01 Prompt Injection |
| 06 | Control over the reply | Early access | LLM01 Prompt Injection |
| 07 | Tool-call manipulation | Early access | LLM06 Excessive AgencyLLM01 Prompt Injection |
| 08 | Attacks through your application | Early access | LLM05 Improper Output HandlingLLM02 Sensitive Information Disclosure |
| 09 | Attacks hidden in images, audio and video | In construction | LLM01 Prompt Injection |
Attack catalogue based on the Arcanum Prompt Injection Taxonomy by Jason Haddix, Arcanum Information Security (CC BY 4.0).
Contact
Start with Basic today.
When your agent begins to take real actions, talk to us about the rest.
Research inquiries: see the published papers · NDA available for commercial discussions · Toronto, Ontario, Canada