> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-products/ai-security.md).

# AI Security

### **Overview**

Xygeni's **AI Security** product detects security risks in the **AI components used by your applications** — prompts, agents, skills, tools, guardrails, models, and vector stores — directly from source code, **before the application is deployed**. It extends the visibility, prioritization, and control that Xygeni already provides for traditional software supply chain risks to the specifics of AI workloads and emerging AI threat models.

Every finding is classified under the **OWASP Top 10 for LLM Applications and GenAI (2025)** — the taxonomy auditors already know — and, where applicable, tagged with the **OWASP Top 10 for Agentic Applications (2026, ASI)** and the **OWASP Agentic Skills Top 10 (2026, AST)** categories, plus **red-team attack vectors** (Prompt Injection, Indirect Injection, Jailbreaks, RAG Poisoning, Multi-Modal Injection, Data Exfiltration, and more) for filtering and hunting.

### **Protect the AI Attack Surface of Your Applications**

LLM SDKs, agent frameworks (LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, LlamaIndex), MCP servers, and coding-tool skills expose new attack surfaces — tool execution, prompt injection, data exfiltration — that traditional SAST and SCA do not cover. Xygeni's AI Security scanner is built to uncover:

* **Prompt injection surfaces**: system prompts that concatenate unbounded user-controlled content without role separation, delimiters, or guardrails.
* **Unprotected agents**: tool-invoking agents without input guardrails, and agents ingesting external content (web fetchers, RAG retrievers, email/chat parsers) with no sanitization — the classic indirect injection path.
* **Mutable prompt sources**: prompts pulled from a registry (LangSmith, Langfuse, etc.) pinned to a floating label (`@latest`, a branch) instead of an immutable version.
* **Multimodal exposure**: agents accepting image, audio, or video input with no guardrail covering those modalities.
* **Obfuscated jailbreak payloads**: prompt bodies matching known obfuscation classes (base64/hex decoding, Unicode smuggling, typoglycemia).
* **Malicious or typosquatted skills**: coding-tool skill manifests (`SKILL.md`, `AGENTS.md`) whose natural-language body hides malicious directives, and skill names that impersonate well-known skills or integrations.

Deterministic detectors are complemented by an optional **LLM semantic review stage** that judges the *intent* of skill and agent instruction manifests, catching prose-only attacks that no signature-based scanner can see.

For more information regarding AI Security, refer to these sections:

* [AI Security User Interface Guide](/xygeni-products/ai-security/ai-security-user-interface-guide.md)
* [AI Security Scanner](/xygeni-products/ai-security/ai-security-scanner.md)
  * [AI Security Scanner Configuration](/xygeni-products/ai-security/ai-security-scanner/ai-security-scanner-configuration.md)
* [AI Security Detectors](/xygeni-products/ai-security/ai-security-detectors.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.xygeni.io/xygeni-products/ai-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.