team blackbox

Your AI agent just read a shipping notification. Buried in the carrier note is an instruction to email your customer list to an attacker. The agent cannot tell data from instruction — and whole-document guards can't either: they block everything (agent blind) or pass everything (agent hijacked). SpanGuard is the third option: strip the attack, keep the data. An OpenAI-compatible security gateway: tool results, pages, MCP payloads and RAG chunks pass through before the agent reads them. Validated rules + a 135M multilingual span model + a family of sub-million char models find the injection spans and replace them with [stripped] markers — order IDs, totals, names and JSON structure survive untouched. v6 adds three measured layers: a split-conformal bound (over-stripping bounded by construction — 0.8% on 500 fresh adversarial docs), a task-conditioned gate (canonical AgentDojo attack escape 80.6% → 40.3% with the user's task given), and an agent-loop harness that scores outcomes, not vibes: utility 100% with hijack 1.3% — the best combination of four systems. A semantic judge (an LLM reading the cleaned output) audited the rules: 30/30 verbatim-stripped, 0/30 semantic escapes. Everything is open: 7 languages, every weight on Hugging Face, every run record committed and re-verifiable, honest costs published next to every win. CPU-only, ~21 ms per document, no LLM call in the guard path.