Sunglasses: Open-source AI agent input scanner launches free defense layer

Sunglasses is a free, open-source input defense layer designed to protect AI agents from hidden attacks embedded in normal-looking content. The core problem it addresses: malicious instructions hide inside emails, web pages, images, PDFs, QR codes, and audio rather than announcing themselves. Without filtering, an agent follows the hidden instructions unaware the sender may not have intended them.

The tool scans six media types for 69 categories of attacks using 1,106 patterns and 7,648 keywords across 23 languages: English, Spanish, Portuguese, French, German, Italian, Dutch, Russian, Ukrainian, Polish, Czech, Turkish, Azerbaijani, Arabic, Hebrew, Persian, Chinese, Japanese, Korean, Hindi, Bengali, Indonesian, and Vietnamese. It catches prompt injection, credential exfiltration, command injection, memory poisoning, social engineering, authority spoofing, and obfuscation techniques (Unicode evasion, right-to-left obfuscation, leetspeak, Base64-encoded attacks, homoglyph substitution). A "mechanism layer" of 11 shape-based rules identifies attacks by structure rather than exact pattern, so paraphrased variants still trigger. The tool does not touch authentication (OAuth, cookies, tokens, headers) or monitor agent behavior—those are separate concerns.

Execution is 100% local. Text scanning averages <1ms (0.26ms on an M3 Max, single-threaded) with throughput of ~3,800 scans/sec. Image scanning runs OCR, reads EXIF metadata, and detects hidden text regions. Audio and video scanning transcribes via Whisper and then scans the text transcript; it runs in the background (30 seconds to 10 minutes) and never blocks the agent. PDFs are scanned for page text, metadata, and annotations. QR codes are decoded and their content scanned. No cloud calls, no API keys, no telemetry.

Testing on a labeled dataset of 38 real agent-input attacks and 73 famous open-source READMEs (react, kubernetes, numpy, ollama, deno, grype) shows 97.4% recall (37 of 38 attacks caught), 78.7% precision, and 0 false positives in v0.3.1. The tool caught all 30 known-shape attacks and 7 of 8 novel semantic attacks (paraphrases the pattern database has never seen). The one miss is "curl … | bash"—five clean READMEs ship that exact install line, so flagging it would add 5 false positives to catch 1 attack; the authors argue this belongs to runtime control, not text scanning, and test to ensure they do not flag it.

Access is immediate: a browser demo at sunglasses.dev/scan requires no installation (image OCR and scanning run client-side). A Python package (pip install sunglasses) installs zero heavy dependencies for text scanning; optional dependencies for audio and video add Whisper. The CLI includes commands to scan text, files, folders, with JSON output for integration. A Python API (SunglassesEngine for text, SunglassesScanner for media) integrates with LangChain, CrewAI, and agent frameworks via an MCP server. The tool outputs SARIF 2.1.0 format for CI integration and generates daily local HTML protection reports.

The roadmap includes a drag-and-drop web UI, URL scanning, email report delivery, pattern database updates without reinstalling, and a public Threat Registry for tracking AI agent attacks with a 30-day publication window regardless of provider response. Community contributions are requested for attack patterns in non-English languages, false positive reports, adversarial bypass attempts, and integration examples. The tool is released under the MIT License.

AI agents are vulnerable to attacks that do not announce themselves: malicious instructions hidden inside ordinary emails, web pages, images, and documents. Traditional security focuses on authentication (OAuth, cookies, tokens) and behavior monitoring, leaving a gap in input validation—the moment before an agent sees content. Sunglasses fills that gap with a local-only, offline defense layer that does not require machine learning or cloud infrastructure. Its design philosophy is practical: it ships 1,106 patterns and 7,648 keywords across 69 attack categories, backed by 17 normalization techniques to catch evasion (Unicode confusables, leetspeak, Base64 encoding), and a "mechanism layer" that catches the structure of attacks (e.g., something sensitive + a place to exfiltrate it) so paraphrased variants still trigger.

The tool is positioned explicitly alongside existing solutions like Lakera Guard, LLM Guard, NVIDIA NeMo Guardrails, and Azure Prompt Shields. Rather than compete on ML-based detection of novel attacks, Sunglasses emphasizes local execution, zero cost, and compatibility—users can run it alone or layer it with cloud tools via an adapter system. Testing reveals a measured, honest stance on limitations: 97.4% recall on a labeled dataset of 38 real attacks plus 73 open-source READMEs as clean negatives, with 0 false positives in v0.3.1, but a known gap: the string "curl … | bash" appears legitimately in five popular README files and maliciously in attack patterns, so flagging it would add 5 false positives to catch 1 attack—a tradeoff the authors acknowledge should belong to runtime control, not text scanning.

No comments yet. Be the first to share your thoughts!