Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No—not reliably from the wording alone. A request to pay an account can be legitimate when it comes from you and dangerous when it is hidden in a bill PDF. A small open-source project called taintgate explores a different safeguard: track where tool-call values came from, then allow, deny, or ask for approval at the point the agent tries to act.
Why an instruction’s source matters
An agent may read email, PDFs, and web pages, then use tools to send messages, make payments, or run commands. Those sources can contain text phrased like instructions. But text found in a document does not automatically have the authority of a request from the user.
“An AI agent can’t tell who’s giving the orders just by reading the words,” writes Rudratosh Shastri in a September 24, 2026 article introducing taintgate. The project’s central idea is to preserve provenance—the origin of values returned by tools—and use it when the agent makes a later tool call.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThat shifts the security question from “Does this text look malicious?” to “Where did the value used in this action come from, and what should policy allow?” It does not make an external document trustworthy or prove that every unsafe action can be stopped. It provides a policy check at the tool boundary.
#1 Best Overall
How taintgate’s policy gate works
Shastri describes taintgate as a layer between an agent and its tools. A developer wraps tools so the gate can inspect calls and retain information about values in tool outputs. YAML rules can then match a tool, argument, provenance marker, threshold, path, or host condition, and produce one of three decisions: allow, deny, or ask.
The approval function is also supplied by the developer. It could connect to a confirmation button or simply reject a call during testing. The article says overlapping rules resolve in this order: deny overrides ask, and ask overrides allow. That is the project’s described policy behavior, not a general security guarantee.
Where the approach can help
- Payments: Ask when the recipient came from untrusted tool output, ask above a configured amount, or allow a user-specified recipient below a configured threshold.
- Email: Deny forwarding to an address supplied only by untrusted email content.
- Coding agents: Deny access to secret paths and block selected destructive or remote-code shell patterns.
- Web agents: Deny requests to private hosts and cloud metadata addresses. The article says the implementation also recognizes an integer-form representation of the metadata IP.
- Support bots: Ask for human approval when a refund exceeds a configured amount.
Why the bill example still asks about the real payment
The difficult case is not simply rejecting an injected destination. A bill may contain the genuine account number the user needs to pay, while also containing malicious instructions or another destination. If both numbers came from the same PDF, provenance alone marks both as document-sourced. In the demonstrated payment scenario, taintgate therefore asks for approval for both the injected destination and the legitimate one.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →That is a real usability cost: the gate can require a human step for the transaction the user actually intended. It is also a limit of the signal being used. Origin tracking can say that a value came from a document; it cannot, by itself, establish which of two values in that document is legitimate.
A commenter proposed an adjacent design: let the agent prepare or request the payment while keeping signing authority in a user-facing channel the agent cannot alter. The comment presents this as an idea, not evidence that such a design has been implemented or proven effective.
How provenance compares with text detectors and human approval
| Approach | Signal used | Where the check happens | Disclosed trade-off |
|---|---|---|---|
| Text-based injection detector | Whether content looks like an attack | Content scoring | May miss attacks phrased like ordinary content; stricter detection can block safe content. |
| Provenance-aware policy check, such as taintgate | Origin of values used in a tool call | Tool-call boundary | Text-based tracking may lose transformed values, and document-sourced legitimate values can also trigger a check. |
| Out-of-band human approval | Action context reviewed through a separate user-facing authority | A channel separate from the agent’s control | Requires a human step; the cited comment does not establish implementation effectiveness or user experience. |
These approaches use different signals and act at different points. The sources do not provide a controlled head-to-head comparison, so the table is a way to understand their design trade-offs, not a ranking.
What the detector results do—and do not—show
In the September 24, 2026 article, Shastri reports testing 10 open-source detectors against 629 AgentDojo attacks embedded in ordinary-looking tool output. He says the best detector caught about half of the attacks while rarely blocking safe content; two detectors caught all attacks but blocked 98% of safe content. The project’s GitHub repository gives a more specific summary for its best result: 51% detection at 2% false positives. These are author- and project-reported results, not independent validation or an industry-wide rate.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prompt Guard 2 has two distinct reported figures. In the overall 629-attack test, the article says it caught 6 attacks. In a separately scored subset of 27 attacks, it flagged none when each was scored in isolation; its highest score in that subset was 0.14. Those denominators describe different test framings and should not be combined into one result.
These figures describe detector performance in the author’s evaluation. They do not show that taintgate itself prevents all prompt injection in production: a content detector and a provenance policy gate use different signals, and the article’s detector benchmark is not a live-agent evaluation of the gate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Limitations to account for before relying on it
- Transformed values: The described version uses text matching for provenance. Rewritten, split, or encoded values may no longer be recognized as originating in untrusted content.
- Argument names: Policy field names must match the argument names used by the underlying tool. A mismatch can mean a rule does not target the intended value.
- DNS resolution: The author says the gate does not resolve domain names. A public-looking name that points to a private address therefore needs protection at the network layer.
- Evaluation scope: The September 24 article labels the package version 0.1 and says full live-agent evaluation was still future work at that time. That is a publication-time status, not a statement about releases after that date.
What this means for agent developers
Provenance-aware rules are useful to consider when a tool call’s risk depends on where a recipient, path, host, or amount came from. They make that source part of an explicit policy decision instead of treating every sentence an agent reads as equally authoritative.
But the bill example exposes the key design choice: a conservative gate may ask about legitimate values as well as malicious ones if both share the same origin. Developers must decide which actions can be allowed, which must be denied, and which are important enough to interrupt a person for—and should not mistake this project’s benchmark claims for proof of comprehensive protection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
