Enterprise GenAI security: how Guardino Sentinel checks prompts for leaks and injection

Enterprise generative AI security is the practice of keeping credentials, customer data, source code and system prompts out of the text that teams send to external large language models. Guardino Sentinel approaches it at the point where a prompt is written: a browser extension, an API and an MCP server that check the text before it leaves, so teams keep using AI tools while the obvious leaks are caught first.

The quiet gap: generative AI and shadow IT

Teams adopt generative AI quickly. Software engineers paste stack traces into ChatGPT to debug a service. Product managers feed research notes and interview transcripts into Claude to draft requirements. Analysts use chat assistants to model scenarios.

These tools save real time, and they also open a path that traditional controls do not see. A network firewall looks at ports, IP addresses and hostnames. When an employee opens an approved AI service over HTTPS, the network sees an encrypted request to an allowed domain. It does not see that the request contains a database password.

Once a connection string, an API key or a customer record is in a prompt, three risks follow:

1. Provider retention: prompts may be kept in the provider's logs for debugging, abuse monitoring or model improvement, depending on the plan and the data retention terms in place.
2. Resurfacing: data that enters a training pipeline may, in some cases, resurface in answers given to other users.
3. Indirect prompt injection: AI workflows that read external documents, emails or web pages can be steered by instructions hidden inside that content.

Guardino Sentinel moves the check to the prompt itself, before any of this can happen.

How pre-send prompt inspection works

Classic data loss prevention was built for files, email and network traffic. It usually does not look at the text a person types into a chat box, and it is rarely placed where an agent assembles a prompt in code.

Guardino Sentinel inspects the text before the request is sent. The browser extension checks the chat editor on the page. The REST API and the MCP server check text that your own code or agent is about to send. The LLM gateway, also in beta, sits in front of OpenAI and Anthropic API calls and runs the same check on each request.

Because the check happens before the request leaves, a flagged prompt can be edited, masked or sent anyway, and the person at the keyboard decides.

The three layers of Guardino Sentinel

A pilot of Guardino Sentinel usually covers two groups: people using AI chat tools in the browser, and developers whose agents send prompts from code.

1. The browser extension and Ghost Mode

The extension (beta, Chrome) watches the prompt box on ChatGPT, Claude, Gemini, DeepSeek and Microsoft Copilot. Every check runs locally inside the extension.

While you type, a small panel next to the editor shows what it found: nothing, sensitive data with a count by kind, or an injection attempt. Ghost Mode rewrites the flagged parts in place, so a Stripe secret key in a configuration block becomes [REDACTED_API_KEY], and nothing is sent until you press send.

At send time the extension applies a simple policy. A prompt injection attempt is held until the text changes. A secret or personal data raises a warning with two choices, "Mask & send" or "Send as is". A per-install switch can make secrets block as well.

The model receives the masked prompt and can still work with its structure. The placeholder is not swapped back in the answer: the model never had the value, so neither does its reply. Two limits matter for a pilot. Only the main prompt editor is watched, so file uploads and pasted images are not inspected yet, and the site selectors need a hand check whenever one of the five sites changes its layout.

2. The agent layer through the Model Context Protocol

Coding agents such as Claude Code and Cursor read files, run commands and fetch web pages. The Sentinel MCP server, @guardino/sentinel-mcp, gives an agent five tools it can call around each step:

• scan_prompt_safety checks text for injection and jailbreak patterns, secrets and personal data, and returns ALLOW, WARN or BLOCK with rule ids.
• redact_secrets replaces keys, tokens, private keys, connection strings and personal data with placeholders.
• generate_canary and verify_output_leak plant a canary token in a system prompt or document and check each completion for it.
• report_incident sends masked findings (rule id, masked excerpt, hash) to your Guardino account, and only when you configure a key.

The agent decides when to call these tools, through its instructions or hooks; the MCP server does not place itself in the agent's path. Four of the five tools run entirely inside the MCP host, so the text does not leave the machine. The npm release is pending.

3. Canary tokens

A canary is a unique, meaningless token, such as gdo_canary_<uuid>, that you add to a prompt or a system instruction. The extension then watches the page for the token appearing again beyond your own message, and the MCP tool verify_output_leak checks a completion for it. If it shows up where it should not, the instructions or the prompt have escaped, and whatever they contained should be rotated.

This is a best-effort, text-based check of what you can see. It does not audit a provider's training data or its retention.

Mapping to the OWASP Top 10 for LLM Applications

Guardino Sentinel's rules are tagged against the OWASP Top 10 for LLM Applications (2025). This is a coverage map, not a compliance claim; OWASP does not certify products.

• LLM01: Prompt Injection: rules for instruction overrides, jailbreak role-play, delimiter escapes and indirect injection, with normalisation against hidden Unicode characters and encoded payloads.
• LLM02: Sensitive Information Disclosure: provider fingerprints and entropy checks for API keys, tokens, private keys and connection strings, plus checksum-validated patterns for card numbers (Luhn), IBAN (mod-97) and Turkish ID numbers (TCKN), email and phone.
• LLM06: Excessive Agency: a rule flags untrusted input that steers connected tools toward destructive or exfiltrating commands. Sentinel reports it; enforcing tool permissions stays with the agent host.
• LLM07: System Prompt Leakage: requests to reveal the system prompt are flagged, and completions can be checked for canary tokens or verbatim runs of your instructions.

The other categories of the list are on the roadmap.

Rolling it out as a pilot

Guardino Sentinel is in beta, so the first step with a team is a scoped pilot rather than a company-wide rollout:

1. Scope: agree which teams, AI tools and kinds of data the pilot covers, and what counts as a useful result.
2. Install: the extension is loaded on the pilot machines, and developers add the MCP server to their agent configuration. A store listing and managed deployment through Chrome Enterprise policies come after the beta.
3. Policy: choose whether secrets only warn or also block at send time. This is a per-install setting today; central policy management is on the roadmap.
4. Review: the team looks at what was flagged, from the extension's counters and, with an account key, from the masked events on the Guardino dashboard, and adjusts the rollout.

Frequently asked questions

What is Guardino Sentinel in an enterprise context?

Guardino Sentinel is a GenAI prompt firewall and DLP layer, currently in beta. It checks prompts for prompt injection, API keys and personal data before they reach an external model, through a browser extension, a REST API, an MCP server and an LLM gateway.

How does Ghost Mode keep data on the device?

Detection runs inside the browser extension, and the prompt is not sent to Guardino. Ghost Mode rewrites the flagged parts in place with [REDACTED_…] placeholders before you send. A warned message can still be sent as it is, and file uploads and pasted images are not inspected yet.

Does Guardino Sentinel interfere with AI output accuracy?

Masking replaces a secret with a placeholder such as [REDACTED_API_KEY], so the model sees the structure of the text but not the value. For most debugging and drafting work that is enough. When a task needs the real value, the model cannot use it, which is the point.

How does Sentinel map to the OWASP LLM Top 10?

Its rules are tagged against the 2025 list: LLM01 (prompt injection) and LLM07 (system prompt leakage) have dedicated rules, LLM02 (sensitive information disclosure) is covered by secret and personal data detection, and LLM06 (excessive agency) has a rule for input that steers tools toward destructive actions. The other categories are on the roadmap. OWASP does not certify products.

Can Guardino Sentinel integrate into autonomous coding agents?

Yes, through an MCP server, @guardino/sentinel-mcp, with five tools: scan_prompt_safety, redact_secrets, generate_canary, verify_output_leak and report_incident. Four of them run entirely inside the MCP host. The npm release is pending; pilot teams get the package from us directly until then.

Try it with your team

Generative AI is part of daily work now. The goal is to keep secrets and personal data out of prompts without slowing people down. Guardino Sentinel is in beta, and we run pilots with teams that want to test it on their own workflows.

ChatGPT, Claude, Gemini, DeepSeek, Copilot, Cursor, Stripe, AWS and OWASP are trademarks of their respective owners, named here only to describe compatibility.

Read this enterprise guide in Turkish at Türkçe.

Request a Sentinel demo