Learn
The problems, explained before the product
What guardrails are, what prompt injection actually looks like, why models hallucinate, and what can go wrong between an agent and its MCP servers – written for engineers deciding what to defend against, not just what to buy.
Explainers
What are LLM guardrails?
LLM guardrails are runtime checks that sit around a language model and enforce rules the model itself cannot guarantee: what may go in, what may come out, and – for agents – what actions may run. The model stays probabilistic; the guardrails are the deterministic layer that decides whether its input and output are acceptable.
What is prompt injection?
Prompt injection is an attack where text the model reads carries instructions the model follows – instructions the application author didn’t write. It works because a language model has no channel separation: system prompt, user message, retrieved document, and tool result all arrive as tokens, and the model weighs all of them when deciding what to do next.
What are AI hallucinations?
An AI hallucination is output a model states as fact that is not supported by its input or by reality: an altered figure, an invented citation, a confident claim its sources cannot back. The model is not malfunctioning when it does this – it is doing exactly what it was built to do, continue text plausibly – and plausible is not the same as true.
What is MCP security?
The Model Context Protocol (MCP) is the emerging standard for connecting AI agents to tools: an agent discovers a server’s tools from its manifest, calls them, and feeds the results back into its context. MCP security is the discipline of not trusting any step of that sentence.
AI hallucination examples: the incidents that made case law
Hallucination stops being an abstract model property the day it produces a court ruling, a sanctions order, or a nine-figure market reaction. The incidents below are public, documented, and instructive – because each one failed in a way a specific boundary check is designed to catch.
What is excessive agency?
Excessive agency is the risk that an AI agent holds more capability than its task requires – more tools, broader permissions, more autonomy – so that when something goes wrong (a hallucination, an injection, a plain bug), the agent has the power to turn the error into damage. It is risk LLM06 in the OWASP Top 10 for LLM Applications, and it is the defining security problem of the agent era.
The LLM security checklist
A working checklist for teams shipping an LLM feature or agent to production. It is organized the way the risk actually flows – what enters the model, what leaves it, what it is allowed to do, and how you will know what happened – and each item states what “done” means, because “we have a filter” is not a state of doneness.
The AI security challenges of 2026
In 2023, AI security mostly meant one worry: a chatbot might say something wrong or embarrassing. In 2026 the picture is different. Employees don’t just chat with AI – they give AI agents permission to act for them: send the email, update the record, file the ticket, pay the invoice. Security teams run agents of their own to triage alerts. And a new standard, MCP, wires those agents into real systems with real credentials.
Do local LLMs have guardrails?
Partly – and not the part most teams assume. An open-weight model you pull with Ollama carries refusal training in its weights, so it declines some harmful requests on its own. What it does not carry is a runtime: no moderation service between the model and your application, no policy to enforce, no record of what was asked. Ollama, LM Studio, llama.cpp and vLLM are model runners – none of them ships a content filter of its own.
Agent inner loop security
An AI agent does not answer once and stop. It works in a loop: it thinks about the goal, uses a tool, reads what comes back, and thinks again – until it decides the job is done. That cycle is the agent’s inner loop.
Inside-the-loop vs outside-the-loop
Every safety check sits somewhere, and where it sits decides what it can see – and whether the AI can talk its way past it. Inside the loop means the check runs inside the agent’s own program: a rule in your code, an instruction in the prompt, a second AI reviewing the first. Outside the loop means it runs at a door the agent has to walk through, between the agent and the model or its tools.
Model Context Protocol security advisories in 2026
The Model Context Protocol – MCP – is the standard that lets AI assistants plug into real tools: your files, your ticketing system, your database. It went from a niche idea to ordinary plumbing very fast, and 2026 is the year the security bill arrived. A government agency published formal guidance on it, and researchers filed hundreds of vulnerability reports against MCP software.
Reference pages
OWASP Top 10 for LLM Applications – coverage map
Each of the ten risks, what it is, and exactly which guardrail addresses it – including the two we only partially cover and the one a runtime proxy honestly can’t.
Library vs gateway vs proxy – choosing an approach
The four ways teams deploy guardrails, what job each is actually good at, and when a proxy on the wire is – and isn’t – the right call.
The guardrails glossary
Thirty terms in a paragraph each – the attacks, the defenses, and the operating concepts – each linking to the page that treats it in depth.
Compliance mappings – EU AI Act, GDPR, HIPAA
Which obligations touch LLM traffic and which runtime check supports each – without pretending a tool confers compliance.
Prefer to see it rather than read about it?
We’re running a limited demo – sign up and we’ll get you in as soon as we can.