Threat coverage
Prompt injection is one item
on this list.
Marlo is often described as prompt-injection defense, which undersells it. Most agent failures are not attacks at all. They are retries, misunderstandings, overreach, and delegation confusion. Marlo treats those the same way it treats a hostile payload: as an action without a valid reason behind it.
- 01
Indirect prompt injection
Instructions embedded in a web page, email, document, ticket, database record, or tool result. Marlo does not need to detect that the content is malicious. Content classified as data cannot expand authority, so the resulting action fails policy whether or not anyone recognized the payload.
- 02
Tool poisoning
A malicious or compromised MCP server alters its tool descriptions, annotations, results, or suggested next actions. Marlo tracks server trust and prevents server-supplied content from independently authorizing unrelated actions.
- 03
Excessive agency
The user asks for a recommendation and the agent takes the action instead. Marlo treats recommend, draft, prepare, schedule, send, execute, delete, and purchase as distinct authorities, because they are.
- 04
Data exfiltration
An agent combines sensitive internal data with an external communication tool. Marlo evaluates the full data ancestry behind the outbound call, not just the parameters of the final request.
- 05
Duplicate transactions
A retry produces a second refund, a second purchase, a second deployment, or a second identical email. Causal transaction identity and execution constraints prevent the repeat side effect even when the retry itself is legitimate.
- 06
Privilege chaining
A low-risk tool returns information that leads the agent to invoke a high-risk one. Marlo requires a valid authority chain for that transition rather than treating the earlier call as implicit permission.
- 07
Stale approval
An approval from an earlier plan, an earlier parameter set, or an earlier session gets reused after the action has changed. Approvals bind to the exact action, parameters, session, and expiry.
- 08
Agent loops
The model calls the same tool repeatedly because it misreads an error. Marlo recognizes the repeating causal pattern and stops it before it becomes a bill.
- 09
Compromised or incorrect tools
The tool performs a different action than the one requested. Where the downstream system exposes enough evidence, Marlo compares the proposal against the observed effect and flags the mismatch.
- 10
Multi-agent confusion
One agent treats another agent's message as user authority. Explicit delegation chains make the real authority visible, and scoped.
- 11
Overly broad scopes
Broad tool permissions make compromise worse and hide the intent behind individual operations. Marlo adds the per-operation layer that broad scopes erase.
Which of these is already
happening in your environment?
Shadow mode answers that in about two weeks.