Chronicle/Defense & research

Meta releases LlamaFirewall guardrails with PromptGuard 2 and AlignmentCheck for agents

May 6, 2025DefenseTool releaseSignificance assistant-drafted

Meta open-sources LlamaFirewall, combining PromptGuard 2 (a jailbreak and injection detector), AlignmentCheck (a chain-of-thought auditor for goal hijacking) and CodeShield (static analysis of generated code). On AgentDojo, Meta reports that the combination cut attack success from 17.63% to 1.75% while utility fell from 47.73% to 42.68%.

Why it matters

It is an open guardrail stack whose detector component was later shown to fail under adaptive attack.

Key facts

As stated in the sources, with where to find them.

AgentDojo baseline: 17.63% ASR, 47.73% utility. PromptGuard 2 86M alone: 7.53% ASR. AlignmentCheck (Llama 4 Maverick) alone: 2.89% ASR, 43.09% utility. Combined: 1.75% ASR, 42.68% utility.Section 4.3.2

Findings that cite this record

No tracked finding cites this record yet.

Sources

LlamaFirewall: An open source guardrail system for building secure AI agentsarXivMay 6, 2025Primary sourceAccessed Sep 25, 2026
LlamaFirewall (HTML)arXivMay 6, 2025Primary sourceAccessed Sep 25, 2026

Related records

Mar 24, 2025

Google DeepMind's CaMeL defeats prompt injections by design with capability-based control and data flow

DefensePaperGoogle DeepMind, Google, ETH Zurich

Oct 10, 2025

'The Attacker Moves Second': adaptive attacks bypass 12 published jailbreak and injection defenses

DefensePaperarXiv

Jan 31, 2025

UK publishes AI Cyber Security Code of Practice with 13 principles, later standardized as ETSI TS 104 223

PolicyStandardUK Department for Science, Innovation and Technology, ETSI

Mar 24, 2025

NIST AI 100-2 E2025 taxonomy adds a dedicated section on security of AI agents

PolicyStandardNIST, UK AI Security Institute, US Center for AI Standards and Innovation

Jun 9, 2026

NIST scientist argues no finite guardrail set is robust to adversarial prompts, urges continuous updates

PolicyGuidanceNIST

Nov 7, 2025

OpenAI describes its layered approach to prompt injection as a frontier security challenge

DefenseFrameworkOpenAI

Organizations: Meta
Topics: Prompt injection Monitoring & control
Attack surface: Monitor Untrusted content Agent model
Methods: Detection classifiers and guardrails Jailbreaking safeguards
Benchmarks and tools: LlamaFirewall AgentDojo Llama
Fide research: FID-074: Agent alignment and runtime assurance
Record: meta-llamafirewall-2025 · added 2026-09-25

Cite this record

Fide AI. "Meta releases LlamaFirewall guardrails with PromptGuard 2 and AlignmentCheck for agents." Agentic Cyber Explorer, record meta-llamafirewall-2025. https://agentic-cyber-explorer.pages.dev/events/meta-llamafirewall-2025/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-meta-llamafirewall-2025,
  author = {{Fide AI}},
  title = {Meta releases LlamaFirewall guardrails with PromptGuard 2 and AlignmentCheck for agents},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/meta-llamafirewall-2025/},
  note = {Record meta-llamafirewall-2025; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.