{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/meta-llamafirewall-2025/",
 "asOf": "2026-09-26",
 "id": "meta-llamafirewall-2025",
 "date": "2025-05-06",
 "datePrecision": "day",
 "title": "Meta releases LlamaFirewall guardrails with PromptGuard 2 and AlignmentCheck for agents",
 "lane": "defense",
 "kind": "tool-release",
 "summary": "Meta open-sources LlamaFirewall, combining PromptGuard 2 (a jailbreak and injection detector), AlignmentCheck (a chain-of-thought auditor for goal hijacking) and CodeShield (static analysis of generated code). On AgentDojo, Meta reports that the combination cut attack success from 17.63% to 1.75% while utility fell from 47.73% to 42.68%.",
 "whyItMatters": "It is an open guardrail stack whose detector component was later shown to fail under adaptive attack.",
 "actors": [
  "meta"
 ],
 "topics": [
  "prompt-injection",
  "monitoring-and-control"
 ],
 "atlas": [
  "monitor",
  "untrusted-content",
  "model"
 ],
 "artifacts": [
  "llamafirewall",
  "agentdojo",
  "llama"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2505.03574",
   "publisher": "arXiv",
   "title": "LlamaFirewall: An open source guardrail system for building secure AI agents",
   "date": "2025-05-06",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://arxiv.org/html/2505.03574",
   "publisher": "arXiv",
   "title": "LlamaFirewall (HTML)",
   "date": "2025-05-06",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "AgentDojo baseline: 17.63% ASR, 47.73% utility. PromptGuard 2 86M alone: 7.53% ASR. AlignmentCheck (Llama 4 Maverick) alone: 2.89% ASR, 43.09% utility. Combined: 1.75% ASR, 42.68% utility.",
   "locator": "Section 4.3.2"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-074"
 ],
 "methods": [
  "injection-classifiers",
  "jailbreaking"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}