Developer adds prompt injection gate to personal AI agent, benchmark shows 89% interception rate

Developer Juraj Bednar built a prompt injection gate plugin for his self-hosted Hermes Agent, which extracts and scores tool results before they are written into the conversation. In benchmarks, the best detector, Jev, intercepted 89% of attacks at a 3.5% false positive rate, including plain instructions hidden in ordinary emails. The plugin first uses pure code to extract invisible Unicode, hidden HTML, base64, image OCR, and metadata, then asks a decision model two questions and gives a probability, allowing or isolating based on a threshold, logging only metadata, not content. On 718 test samples, Jev had an AUC of 0.981, and for injected email slices 1.000; the local model Nimble 9B 4-bit had an overall AUC of 0.927 and for injected emails 0.990, which is the author's recommended local alternative, but it still misses more email attacks than Jev. The author reports that out of 4,614 real tool results in one week, 159 were blocked, all false positives; plugin version 0.6.0 structurally fixed four of those categories, with the remaining 59 being the model's misjudgments of normal content.