GhostFilter AI

GhostFilter helps people check suspicious messages, links and files, while also stopping prompt injection before unsafe content reaches an AI agent.

Comment

Inspiration

Scam messages are becoming harder to spot. They often look ordinary, create urgency and ask for a payment, password or OTP before the recipient has time to think.

At the same time, AI agents face a similar problem. An email, webpage or document can contain hidden instructions that try to override the agent, reveal secrets or trigger unsafe actions.

We built GhostFilter because both problems begin with the same question: can this content be trusted?

What it does

GhostFilter is a safety layer for people and AI agents.

For people, it checks messages, emails, links and files for phishing, impersonation, payment scams, credential theft and suspicious pressure tactics.

For AI agents, the GhostGPT Firewall detects prompt injection, jailbreak attempts, secret extraction and unsafe tool instructions. It can block risky content or place it inside a safer context wrapper before an AI agent reads it.

Ghosti is the built-in safety assistant. It explains findings in plain language and suggests what to do next. Locally, Ghosti can use an open-source model through Ollama. If that model is unavailable, deterministic safety checks provide a fallback response.

How we built it

The web application uses Next.js, React and TypeScript, with Convex handling data, connected accounts and scan history.

The detection pipeline combines several layers:

  • a locally trained logistic-regression classifier
  • deterministic scam and social-engineering rules
  • prompt-injection and unsafe tool-use detection
  • email header checks
  • link and domain analysis
  • VirusTotal and urlscan.io reputation data
  • selective Gemini review for cases that need deeper analysis

We also created ghostfilter-ai, a local-first npm SDK and CLI. Developers can add the same scam and prompt-injection checks to their own applications without running the full web platform.

Ghosti Guard, our browser extension prototype, can scan selected webpage text or the visible page before that content is passed to an AI agent.

Challenges we faced

The hardest part was avoiding false positives. A message mentioning a payment or account alert is not automatically a scam. We had to combine context, intent and supporting evidence instead of trusting one keyword or model score.

We also wanted the product to remain useful when an external AI provider was unavailable. That led us to build local checks and clear fallback behavior rather than making every scan depend on one API.

Authentication and privacy required careful work too. User accounts are stored in Convex, passwords are salted and hashed with scrypt, OAuth tokens are encrypted and connected services use read-only permissions.

What we learned

We learned that a safety product should explain its reasoning. A risk score alone is not enough. People need to know what was detected and what action they should take.

We also learned that prompt injection and human-focused scams share many techniques: urgency, impersonation, hidden authority and attempts to bypass normal verification.

What we are proud of

GhostFilter is more than a demo screen. It includes a deployed web application, production backend, browser extension prototype, developer documentation and a published npm package.

Our current regression suite covers 50 scam and prompt-injection cases. The product still states its limits clearly because automated safety checks can reduce risk, but they cannot guarantee that content is safe.

What is next

Future work includes multilingual scam detection, larger independent evaluations, hosted open-model inference, password recovery, email verification and browser-store distribution.

Built With

Share this project:

Updates