Prompt Injection Detection Tools: The 2026 Landscape for LLM Defenders

Prompt injection sits at the top of the OWASP LLM Top 10 for 2025 ↗, and OWASP is blunt about the state of the art: given how language models work, “it is unclear if there are fool-proof methods of prevention.” That caveat is exactly why prompt injection detection tools exist as a category. If the model itself cannot reliably distinguish instructions from data, teams bolt a classifier in front of it, scan what goes in and what comes out, and treat detection as one layer in a defense-in-depth stack. The market for that layer has changed sharply over the past year: two of the best-known vendors were acquired, one major open-source project was archived, and the surviving options now split cleanly into open-weight classifiers, cloud APIs, and orchestration frameworks.

What these tools actually do

A prompt injection detector is a classifier that evaluates text before (and sometimes after) it reaches your LLM. OWASP’s LLM01 entry distinguishes two attack forms the tools must cover: direct injection, where the user’s own input manipulates the model, and indirect injection, where the payload arrives inside external content the model ingests, such as a retrieved web page, an email, or a document in a RAG pipeline. Indirect injection is the harder problem and the one most relevant to agent deployments, since the attacker never touches the chat box. For a deeper breakdown of why the two classes demand different controls, see direct vs. indirect prompt injection ↗ on our sister site.

Detection is necessary but not sufficient. OWASP’s recommended mitigations pair input/output filtering with constrained system prompts, output-format validation, least-privilege access for tools, and human approval for high-risk actions. Any vendor pitching a detector as a complete fix is overselling it.

The current tool landscape

Meta Llama Prompt Guard 2 is the strongest open-weight option. The 86M-parameter model ↗, built on mDeBERTa-base, performs binary benign/malicious classification over a 512-token window and, per the model card, reaches 0.998 AUC with 97.5% recall at a 1% false-positive rate on English jailbreak detection. A 22M variant on DeBERTa-xsmall cuts latency and compute by a stated 75% with minimal accuracy loss, which matters when you are scanning every chunk of retrieved context. Both support eight languages and ship under the Llama 4 Community License. The tradeoff: you host it, you tune the threshold, you own the false positives.

Microsoft Prompt Shields is the managed-API route. Prompt Shields ↗, part of Azure AI Content Safety and formerly named “Jailbreak risk detection,” runs two shields: one for user-prompt attacks (system-rule changes, conversation mockups, role-play personas, encoding attacks) and one for document attacks, which screens third-party content for embedded instructions aimed at exfiltration, fraud, or code execution. Models are trained and tested on eight languages including English, Chinese, Japanese, and German. Microsoft’s own docs concede false positives and negatives occur and advise additional validation layers. For Azure-native shops it is the lowest-friction choice.

Lakera Guard remains the best-known commercial dedicated detector, now operating under Check Point, which announced the acquisition in September 2025 ↗. Lakera’s platform ↗ advertises sub-50 ms runtime latency, coverage across 100+ languages, and blocking of prompt injection, jailbreaks, and adversarial instructions before they reach the model, with newer capabilities aimed at agent-specific risks such as indirect injection through MCP-connected systems. The Check Point deal is part of a broader pattern: standalone AI-security startups are being folded into platform vendors, so evaluate roadmap continuity, not just detection quality.

NVIDIA NeMo Guardrails is a framework rather than a single detector. The Apache 2.0 toolkit ↗ lets you compose input, dialog, retrieval, execution, and output rails, with built-in protections against jailbreaks and prompt injection plus integrations for third-party detectors including ActiveFence and AlignScore. Retrieval and execution rails are the notable part: they apply checks to RAG chunks and tool calls, which is where indirect injection actually lands in agentic systems.

Protect AI LLM Guard is the cautionary tale. The MIT-licensed toolkit, which bundled a PromptInjection scanner among 15 input scanners and 20+ output scanners and was a default pick for air-gapped deployments, was archived on July 9, 2026 ↗ and is no longer maintained. Protect AI itself was acquired by Palo Alto Networks in July 2025 ↗. Teams still running it should treat it as frozen code with an unmaintained detection model behind it and plan a migration.

How to choose

Four questions separate the options faster than any feature matrix:

Where can the data go? If prompts cannot leave your network, open-weight models (Prompt Guard 2, self-hosted rails in NeMo Guardrails) are the shortlist. Cloud APIs like Prompt Shields and Lakera trade data residency for zero-maintenance detection updates.
Do you need indirect injection coverage? Chatbot-only deployments can get away with scanning user turns. Anything with RAG, browsing, email ingestion, or tool use needs document/retrieval scanning, which Prompt Shields (document shield), Lakera, and NeMo’s retrieval rails address explicitly.
What latency budget exists? A detector in the hot path adds a round trip per request. Published figures (Lakera’s sub-50 ms claim, Prompt Guard’s 22M distillation) exist because this is the binding constraint at scale.
Who maintains it in two years? The LLM Guard archive and the Lakera and Protect AI acquisitions all landed within roughly a year. For open source, check commit activity before committing; for vendors, ask what the acquirer’s roadmap says.

Whatever you pick, position it as one control among several. Layer the detector with output validation, tool-permission scoping, and the guardrail patterns covered in our sister site’s LLM guardrails guide ↗, and red-team the combined stack rather than trusting any single classifier’s benchmark numbers. OWASP’s adversarial-testing recommendation is the one mitigation that tells you whether the rest are working.

Sources

LLM01:2025 Prompt Injection, OWASP Gen AI Security Project ↗: the canonical definition of direct and indirect injection and the mitigation list referenced throughout this piece.
Prompt Shields in Azure AI Content Safety, Microsoft Learn ↗: official documentation for Microsoft’s user-prompt and document attack shields, including attack subtypes and language coverage.
Llama Prompt Guard 2 86M model card, Hugging Face ↗: Meta’s published architecture, benchmark, and licensing details for the open-weight classifier.
LLM Guard repository, Protect AI ↗: source for the toolkit’s scanner list, MIT license, and its July 2026 archival notice.
NeMo Guardrails repository, NVIDIA ↗: documentation of the five rail types and third-party detector integrations.
Lakera Guard product page ↗: vendor-stated latency, language coverage, and agent-security capabilities, published under Check Point ownership.