Interlock: A Runtime Firewall That Assumes Prompt Injection Already Won
Key Takeaways
- ▸Shifts security from prevention (stopping prompt injection) to detection: assumes injection succeeds and monitors for exfiltration via byte-level analysis
- ▸Dual detection architecture: MCP proxy inspects JSON-RPC wire protocol; eBPF sensor monitors syscalls for proof of secret exfiltration
- ▸100% EXFIL-tier detection with 0% false positives by enforcing only on provable byte overlap between secrets and outbound data, never on session shape alone
Summary
Interlock, a new runtime security tool for AI agents, takes a paradigm-shifting approach to agent compromise detection. Rather than attempting to prevent prompt injection—which the author argues is an unwinnable arms race against natural language—the tool assumes injection will succeed and focuses on detecting actual data exfiltration at the sink. Interlock operates on two detection planes: an MCP proxy monitoring JSON-RPC traffic and an eBPF sensor tracking syscalls, enforcing controls only when it proves byte overlap between known secrets and outbound traffic.
The tool addresses what researcher Simon Willison termed the "lethal trifecta": AI agents simultaneously having access to private data, exposure to untrusted content (poisoned tool results), and the ability to communicate externally. Tool poisoning—where attacker instructions arrive inside tool results and the model treats them as trusted context—enables data exfiltration through individually authorized tool calls. Each step appears reasonable in isolation, making detection challenging.
Early testing shows 100% EXFIL-tier detection (31/31 malicious attempts) with 0% false positives (0/37 benign operations) and 18.9% soft alerts across all detection types. Critically, the creator published an explicit ledger of structural limitations—semantic paraphrase of secrets is permanently out of scope—reflecting a design philosophy that prioritizes verifiable claims over aspirational feature coverage.
- Addresses the 'lethal trifecta': concurrent access to private data, untrusted content, and external communication—the structural shape of data walking out
- Published ledger of limitations (semantic paraphrase detection permanently out of scope) sets new transparency standard for AI safety tools
Editorial Opinion
Interlock represents a conceptual breakthrough in AI agent security by abandoning the quixotic quest to prevent prompt injection and instead embracing practical defense-in-depth at the data boundary. The author's insistence on publishing structural limitations alongside performance metrics—rare in security tooling—reflects genuine confidence in what the system actually protects against. If this approach proves robust in production, it could become essential infrastructure for any organization deploying AI agents with access to sensitive data.
