MixShield

AI agents read emails, chats and documents, and attackers can hide instructions in that text (indirect prompt injection). The attacker chooses the language. MixShield tests and protects tool-using agents against hidden instructions written in English, Hinglish (Hindi and English mixed, typed in English letters) and Hindi. It has two parts: 1. A benchmark on AgentDojo: 300 attacks and 450 benign texts in three languages, plus 30 adaptive attacks. On the test split, Llama Guard 3 caught 84.3% of attacks in English but only 68.6% in Hinglish (McNemar p = 0.000145), and Llama Prompt Guard 2 at its default threshold caught 0 of 70 in every language. 2. An open-source guard (Python library + MCP proxy) with two checks: a screen that checks every tool output (Llama Prompt Guard 2 + Muse Spark Open as a code-mixing-aware classifier that gives a reason), and an action gate that checks every payment or message before it runs (allow / ask / block). The MixShield screen caught 99.5% of Hinglish attacks with 0.0% false alarms. With a worst-case simulated agent, MixShield stopped 189 of 189 attacks, while Muse Spark kept 88.5% of real tasks working (92.3% with no defence). Limits are listed openly in the README (simulation, 2 of 27 adaptive attacks got through in default mode).