TrapScan

• 

  landing page

Inspiration

AI agents are increasingly able to browse the web, read documents, search for information, and interact with tools autonomously. But the same capability that makes agents useful also creates a new attack surface: untrusted content can contain instructions designed to manipulate the agent.

A webpage can appear completely normal to a human while containing a prompt injection such as an instruction to ignore the agent's original task, expose sensitive information, or perform an unintended action.

We built TrapScan around a simple question:

What if AI agents had a security layer that could detect the trap before the agent followed it?

---

What it does

TrapScan is a browser-native defense layer for AI agents that detects adversarial content and prompt injection attempts before they can influence an AI workflow.

It combines two approaches:

• Local pattern detection for fast identification of known prompt-injection patterns.
• AI-powered classification for analyzing contextual and less obvious attacks.

TrapScan analyzes potentially untrusted content and produces a threat assessment so that suspicious or malicious instructions can be identified before they are blindly passed into an AI workflow.

The core idea is to create a security boundary between:

Untrusted Web Content → TrapScan → AI Agent

Instead of assuming that everything an agent reads is trustworthy, TrapScan treats external content as potentially hostile.

---

How we built it

We built TrapScan as a browser-oriented security layer using web technologies and AI-based threat classification.

The detection pipeline works roughly like this:

Web Content
     ↓
TrapScan
     ↓
Local Pattern Detection
     ↓
AI Threat Classification
     ↓
Threat Assessment
     ↓
Safe → Continue
Suspicious/Malicious → Warn / Block

The local detection layer provides fast, deterministic checks for recognizable attack patterns.

For attacks that require more contextual understanding, TrapScan uses an AI classifier to determine whether the content is attempting to manipulate an AI system.

We designed the architecture so that the security layer can operate before untrusted instructions become part of an agent's effective input.

---

Challenges we ran into

The biggest challenge was that prompt injection doesn't have a single recognizable format.

An attacker doesn't necessarily need to write:

"Ignore your previous instructions."

The same attack can be rewritten, disguised as legitimate instructions, embedded inside a webpage, or constructed to look like normal content.

This makes simple keyword filtering insufficient.

We therefore had to think about the problem at two levels: fast deterministic detection for obvious patterns and contextual AI analysis for attacks that require understanding intent.

Another challenge was balancing security and usability. A detector that treats every unusual instruction as malicious would create too many false positives and make legitimate AI workflows frustrating to use.

---

Accomplishments that we're proud of

We're proud that TrapScan turns an abstract AI security problem into something that can be demonstrated directly in the browser.

Instead of only detecting malicious prompts after an AI agent has already processed them, we designed TrapScan around the idea of putting a defensive layer before the agent.

We're also proud of combining traditional security techniques with AI classification rather than depending entirely on an LLM.

Most importantly, TrapScan gave us a practical way to experiment with a problem that will become increasingly important as AI agents gain more autonomy and access to external information.

---

What we learned

We learned that securing AI systems is fundamentally different from securing traditional web applications.

Traditional security often asks:

"Is this request or file malicious?"

AI security also needs to ask:

"Is this content attempting to change the behavior of the AI?"

That makes the boundary between data and instructions extremely important.

We also learned that AI-based security shouldn't necessarily mean replacing deterministic security mechanisms with an LLM. A combination of fast local checks and contextual AI analysis can provide a more practical architecture.

---

What's next for TrapScan

TrapScan currently focuses on protecting AI workflows from adversarial web content, but the same concept can extend much further.

Our next steps are to expand protection across:

• Web pages
• Documents
• Emails
• Search results
• Tool outputs
• MCP/tool responses
• Agent-to-agent communication
• Multi-step autonomous workflows

We also want to improve detection accuracy, reduce false positives, provide clearer explanations for why content was flagged, and eventually make TrapScan usable as a security layer across different AI-agent platforms.

The long-term vision is simple:

AI agents shouldn't blindly trust the internet. They should have a security layer that checks it first.

Built With

• agents
• ai
• artificial
• browser
• cybersecurity
• extension
• injection
• intelligence
• prompt
• security
• web