StarTek

Agent-Shield is a security gateway for AI agents — now with a Muse Spark semantic-review stage that catches the indirect prompt injections pattern matching misses. THE PROBLEM: AI agents read untrusted content all day — web pages, emails, documents, tool outputs — and indirect prompt injection hides instructions inside that content. Pattern-based (heuristic) scanning is fast and precise, but it has a hard ceiling: on an external holdout of 211 real-world samples, Agent-Shield's production heuristic scanner caught only 4.7% of malicious samples (recall 0.047). The attacks it missed weren't exotic — they were politely phrased, context-dependent injections (the BIPIA, TensorTrust, and HackAPrompt families) that no regex or keyword list can separate from legitimate text. A scanner that misses 95% of real injections gives agent operators false confidence, which is worse than no scanner at all. WHAT WE BUILT: A semantic-review stage inside the production Agent-Shield scanner, powered by the Meta Model API (Muse Spark 1.3). Heuristic-first: every scan runs through the existing fast pattern engine first; the semantic stage only sees what the heuristics called clean or borderline-suspicious — it never spends model calls where it cannot change the outcome. Escalate-only merge: the model returns a strict-JSON verdict (label + confidence + a one-line reason) and can escalate a verdict (clean → suspicious → malicious, at defined confidence thresholds) but can never downgrade one — downgrades are impossible by construction. Receipted verdicts: when the semantic stage escalates, it appends a semantic_review finding to the scan before the signed receipt is built, so Agent-Shield's tamper-evident receipt covers the merged verdict. Hard spend stop in code: Meta's own Spend Limit is notification-only, so the stage keeps its own cumulative spend counter (estimated from the API's usage counts at published rates); at a $120 hard stop it disables itself and scanning falls back to heuristic-only — logged loudly, never silently. Fail-safe failure modes: a truncated or unparseable model reply counts as no verdict — the heuristic result stands and the failure is logged; API errors and timeouts behave the same way. The stage is wired into the production /v2/scan endpoint; /v1/scan behavior is completely unchanged. RESULTS: Same external holdout (211 samples), same scoring rule, heuristic stage run identically before and after. Recall 0.047 (8 of 171 malicious caught) → 0.784 (134 of 171). False-positive rate 0.000 (0 of 40 benign flagged) → 0.000. Precision 1.000 → 1.000. By attack family (malicious caught, before → after): TensorTrust 2/40 → 36/40; deepset 3/60 → 47/60; BIPIA (indirect injection) 0/30 → 23/30; HackAPrompt 0/37 → 25/37; gitleaks fixtures 3/4 → 3/4. Honest limits: 37 malicious samples still slip through — mostly short fragments whose attack intent is genuinely thin in isolation. Total cost of the full benchmark run: $1.43 in API spend. WHAT'S LIVE NOW: This is not a demo — the semantic stage is running in production today (deployed and activated Nov 3, 2026). Product: https://agent-shield.startekenterprises.com — Benchmarks (updated Nov 3, 2026, with the before/after table): https://agent-shield.startekenterprises.com/benchmarks — Try it: free signup with a single POST /v1/signup (no email, no form) returns an API key good for 1,000 free scans/day; then POST /v2/scan with the key — heuristic-clean indirect injections now escalate through the semantic stage, with the signed receipt to prove it. Live-verified on Nov 3: heuristic-clean indirect injections submitted to the production endpoint came back malicious with the semantic_review finding inside the signed receipt; benign traffic was untouched. TEAM: Glenn Gross — founder, StarTek Enterprise Solutions LLC (solo founder; bootstrapped). Glenn designed and operates Agent-Shield in production and directed this build; implementation was carried out with the assistance of a standing panel of frontier AI systems (disclosed openly). No other team members, advisors, or metrics are claimed.