Filewall

A triple-layered security middleware for AI coding agents — smarter prompt-injection detection, a confirm-before-write gate, and one-click rollback.

Comment

Inspiration

It started from something small and annoying: watching an AI coding agent quietly make changes to an ongoing project when we were simply asking for an answer rather than proceeding with the next implementations in the middle of changes.

Around the same time, we have ran into more and more stories about prompt injection — people hiding instructions inside a resume in white-on-white text, or slipping a directive into a document an AI is supposed to be evaluating, hoping the model follows the hidden text instead of the human's actual intent. It's already being used to game resume screeners and application reviewers. The next question was: what happens when that same trick is aimed at an agent that can touch your filesystem? An agent silently deleting or rewriting your files because a document told it to is a different category of bad, and can cause major destructive consequences onto a person's files. Now imagine this happening to a major corporation. It can result in massive losses.

We wanted to build the thing that stands between an agent and the damage it could do — something you could bolt onto an agent you already trust, without having to trust it blindly.

What it does

Filewall is a security middleware layer for AI coding agents that adds three independent layers of protection around every file operation an agent tries to make:

Prompt injection detection — a two-tier scanner. A fast static/pattern tier catches obvious injection attempts locally, and a semantic tier asks a second AI model to judge content against the agent's actual purpose — catching hidden text, translated instructions, emotional manipulation, and inflated claims that a regex alone would miss.

Confirmation before anything lands — every file create, edit, or delete happens in an isolated staged copy of the workspace first. The agent never touches your real files directly. You see a real diff of exactly what changed, file by file, and nothing is applied until you click Confirm. You can also just keep typing to refine the same pending proposal instead of starting over. Undo — even after you confirm a change, one click rolls the workspace back to exactly how it was before, like a safety net for the safety net.

None of this required rebuilding the agent platform underneath it. Filewall wraps around the existing flow rather than replacing it — the point was always "enhance," not "reinvent."

How we built it

We started by trying to break things. Before deciding what the middleware needed to do, we spent real time researching how prompt injection attacks actually show up in the wild: hidden text via CSS tricks (zero font size, background-matched color, off-screen positioning), instructions embedded in a different language than the surrounding document, vague-but-confident credential claims, and directives disguised as "system notes" inside a file the agent is asked to read. That research directly shaped what our scanner needed to catch, and became the backbone of the categories our semantic judge checks for.

From there we treated it like a real security feature, not a demo trick: we designed layered defenses on paper first (detection → containment → confirmation → reversibility), and only then started implementing each layer as an independent, testable piece.

Testing was the biggest part of the build. We ran repeated, deliberate case testing against our own agent — building a fake resume-screening agent, planting hidden injected instructions inside a sample resume, and watching whether our scanner actually caught it. Then we tried the opposite: a visible, explicit injection where the surrounding prompt authorized following the file's instructions, to make sure the confirmation gate still caught anything that slipped past detection. We iterated on both layers independently — tightening the scanner when it missed something, and hardening the confirmation flow to make sure "the AI said it's done" could never mean it actually was, until a human said so.

Challenges we ran into

A major challenge was definitely in the ideation and research. The agent provided was a lot more advanced and smarter than we have initially anticipated. It was hard to break and bypass it, especially for testing its prompt injection detection capabilities. Research was required on a deeper level, much more than we have anticipated. It was hard to think of ideas while ensuring they are a middleware-focused solution. Many of our ideas came out as more of a change to the features directly, and we have to constantly pull ourselves back to the objective. For challenges towards the agent we were given, the agent itself sometimes would be too slow, or stuck in loading. That was significant drawback for us, as it hindered our productivity and speed towards pushing out features.

Accomplishments that we're proud of

The two things we'd point to first: how reliably the injection scanner catches manipulation attempts that the agent sometimes could not see. It proves that our research were not in vain. And the confirmation gate, which we're genuinely proud turns "trust the agent" into "verify, then trust" — no file change, however small, reaches your real project without a human in the loop seeing the actual diff first.

What we learned

That most of the interesting work in AI safety isn't in the model — it's in the seams around it. The gap between "the agent decided to do X" and "X actually happened to your files" is exactly where trust breaks down if you don't design for it deliberately. In addition, limitations to model detections were also witnessed first hands by us, where we learnt of various techniques as to how human would always try to one-up existing agents in order to "cheat" the system as the agent continuously improve its capabilities.

What's next for Filewall

Support for more model providers beyond our current setup, so the scanner isn't tied to one vendor, and responses could be returned quicker without sacrificing too much accuracy. Packaging Filewall as a standalone layer other agent platforms can adopt, not just our own reference app

Built With

Share this project:

Updates