A retrieval firewall for AI agents

01 — the problem

The attacks arrived as content the agent read

One crafted email made Microsoft 365 Copilot hand over private files and messages from the target's mailbox, OneDrive, SharePoint, and Teams. Nobody had to open it. Microsoft patched the hole in May 2025 and disclosed it in June, with no known customer impact. The researchers who found it called it EchoLeak.1

Researchers have shown the same pattern against Salesforce Agentforce, GitHub Copilot Chat, GitLab Duo, Slack AI, ChatGPT Deep Research, Google Gemini through calendar invites, and six platforms at Black Hat 2025.2 Those specific holes are patched. The class is what recurs. In February 2026 a prompt injection in a GitHub issue title chained into a tampered npm package that reached roughly 4,000 developer machines,3 and CrowdStrike's 2026 threat report describes adversaries injecting malicious prompts into GenAI tools at more than 90 organizations.4

In every case the attack arrived as ordinary content the agent read: an email, a calendar invite, a ticket, an issue, a message, a web page. The stolen data usually left the same way it arrived, through a URL the assistant was told to load. EchoLeak sent it out inside an image address the assistant was already allowed to load, CamoLeak spelled secrets out one image request at a time, and GitLab Duo carried source code away in a link's query string.

This is not a solved problem. OWASP has ranked prompt injection the top risk for AI applications in two consecutive editions and writes that it is unclear whether fool-proof prevention exists.5 Your agents still fetch whatever URL they are handed. Clearfetch sits on that path. Every page is re-rendered into strict markdown, scanned for instructions, and returned with a verdict and a record of where it came from.

1. Cato Networks and Aim Labs on EchoLeak (CVE-2025-32711; CVSS 9.3 as assigned by Microsoft), NVD CVE-2025-32711. · 2. Noma on ForcedLeak in Salesforce Agentforce, Legit Security on CamoLeak in GitHub Copilot Chat, Legit Security on GitLab Duo, PromptArmor on Slack AI, The Record on ShadowLeak in ChatGPT Deep Research, SafeBreach on calendar-invite attacks against Gemini, Zenity Labs on AgentFlayer. · 3. Snyk on the Cline compromise. · 4. CrowdStrike 2026 Global Threat Report. · 5. OWASP on prompt injection (LLM01).

02 — how it works

Channels are eliminated first, then what remains is scored

Clearfetch does two different jobs on ingress, and they carry different guarantees. We keep them apart here, in the docs, and in the response, because collapsing them into one claim is how vendors end up promising immunity.

Layer 1 · deterministic

Channel elimination

HTML is re-rendered into strict markdown. That render provably strips scripts, CSS-hidden text, zero-width characters, and document metadata, because the output format has nowhere to put them. Images are re-rendered or captioned instead of being passed through as live references.

Several published exploits rode exactly these channels. EchoLeak's bypasses used reference-style markdown, and ShadowLeak used white-on-white text. A transform that cannot represent those constructs removes the delivery route rather than judging the payload.

Because images are re-rendered or captioned, the markdown we hand back holds no live image or script URL for a client to fetch automatically, so the rendering channel EchoLeak and CamoLeak used to carry data out is absent from Clearfetch output. That is a claim about what our output contains, not about how those incidents would have gone.

Layer 2 · probabilistic

Injection detection

Whatever survives the transform is scanned for instruction-bearing text. Every response carries a verdict of clean, sanitized, or blocked, plus the findings behind it, each with a category, a confidence, and a plain-language detail line.

Detection is statistical, and we publish detection rates instead of claiming immunity; those numbers publish with the API rather than after it. The verdict is a routing signal: quarantine a flagged response, keep it out of a tool-calling context, or send it to a human.

The UK's NCSC says this class of attack may never be totally mitigated, and that lowering the likelihood and impact of attacks is the realistic goal.1 That is why every response carries a verdict instead of a promise. Layer 1 lowers the likelihood by removing delivery channels; layer 2 scores what is left so you can contain it.

surface reduction

Domain allowlists, per API key

Lock a key to the domains and providers you approve. Requests to anything else are refused before a single byte is fetched, and every refusal and every policy change lands in the audit log.

A shorter list is a smaller exposure surface in front of both layers, because fewer sources means fewer places an injected instruction can arrive from. The two layers still run on everything that gets through.

An allowlist governs what this key retrieves through Clearfetch. It does not control what your agent does through other tools, and approved domains still get the full sanitization and scanning pipeline — an allowlist bounds where we fetch, not what we trust.

the other direction

Outbound request inspection

In allowlist mode, a fetch to an unapproved domain is refused outright, and a payload cannot leave through a request that never happens. That refusal is deterministic given the policy on the key.

For open-mode keys, which have no allowlist, the URLs your agent asks us to fetch are scanned for signs that data is being carried out in them: oversized or random-looking query strings, encoded payloads, unfamiliar destinations. Each request gets a verdict, and your policy decides whether a flagged request is blocked or logged.

This applies to retrieval through Clearfetch. It does not inspect traffic your agent sends through other tools. Pattern detection is statistical in the same way injection detection is, so we publish its rates and never claim it catches everything. Those numbers publish with the API rather than after it.

Other vendors use “retrieval firewall” for other products, including data-loss prevention in front of vector databases. We did not coin the phrase. We use it for the open-web ingress path, meaning what your agents read.

1. NCSC, “Prompt injection is not SQL injection” (Dec 2025).

03 — the response

A verdict travels with the content

An internal copilot reading release notes is an unremarkable request. The page is third-party content, so it gets the same treatment as anything else.

The content block is what the model sees. The findings block is what your routing logic reads, and the provenance block is what the incident review reads later.

POST /v1/fetch Example

verdict

verdict sanitized content delivered, one span removed

ok true

license_status unknown no machine-readable license signal on this source

scans · findings

category prompt_injection

confidence 0.94

detail After the deterministic pass, a paragraph of ordinary body text still addressed the reading model directly and asked it to post the caller's environment variables to an external endpoint. The span was removed from the returned markdown and recorded as a finding.

channels removed scripts, css_hidden_text, zero_width_chars, metadata

content

text/markdown · strict render

# Migrating to v4Run the codemod before you upgrade the client library.[ removed · injected_instruction ]Config keys move from snake_case to camelCase.The v3 client keeps accepting writes until 2026-12-01.

provenance

url https://example-devblog.com/posts/migrating-to-v4

domain example-devblog.com

fetched_at 2026-08-01T14:22:09Z

upstream_status 200

content_sha256 9f31c2…d7a4

request_id req_01JZR4K8T2

04 — objections

Objections

These are the three questions we expect first from anyone who has read the incident writeups.

“NCSC says prompt injection may never be fully mitigated, so what does a filter buy me?”

It buys the two things NCSC says are achievable: lower likelihood and lower impact.1 The deterministic layer provably strips whole delivery channels out of a page before your model sees it, and several published exploits rode exactly those channels.

The probabilistic layer scores what is left, and we publish its detection rates rather than a protection percentage. What you get on every response is a verdict you can route on and a record you can audit later.

“Why a retrieval-side product instead of a model-side guardrail or a full AI firewall?”

Run both. A model-side guardrail reads a flattened context, after the untrusted content has already been mixed into the prompt. Clearfetch acts at ingress, where the deterministic transforms are still possible and where provenance can be captured at all.

We do the read side and nothing else. Bidirectional enterprise AI firewalling is Palo Alto and Cisco territory, and Clearfetch is designed to sit under one of those rather than replace it.

“Won't sanitization break the content my agents need?”

Strict markdown drops layout and interactivity by design. That is the trade, and for agent retrieval it is a cheap one: reading, extraction, summarization, and grounding all run on text, and images come back captioned or re-rendered.

If your workload needs raw DOM or script execution, we are the wrong tool for that path.