CAITLYN
Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?
Continuous Agents for Injection Threats via Lifelong Yielding Nexus
Agent-agnostic middleware that inspects untrusted content at runtime and turns
new prompt-injection failures into verified, reusable defense skills.
Project website ·
Preprint Paper ·
What's New ·
Install ·
Evaluation ·
中文说明
What's New
- 🖥️ 2026-10-26 · 0.7.0 —
caitlyn dashboard is a live fullscreen host watch now! It fills the terminal with occupancy, sockstat, ACE, a ranked /proc table, and a SAFE AGENTS pane, without killing processes!
- 👁️ 2026-10-19 · 0.6.0 — The local daemon is now a resident host watcher! It polls occupancy and network from
/proc, watches agent component grafts with ACE-style energy, and quarantines newly added skills without synthesizing a defense skill from a CPU spike!
- 🔄 2026-10-14 · 0.5.3 —
caitlyn repl actually starts now! Help and README name the live commands, caitlyn install --force refreshes copied plugins, and plugin staging uses Node fs so Windows cmd.exe can build!
- 🎉 2026-10-07 · 0.5.2 — What's New is a dated list now!
caitlyn releases and /releases open the same page!
- 🪟 2026-10-07 · 0.5.1 — Windows skill builds and the OpenClaw, OpenCode, and pi hooks finally start
.cmd shims with a shell! Chinese instruction signatures from the first outside pull request got tighter, and ordinary work sentences stay benign!
- 🕵️ 2026-10-07 · 0.5.0 — Privacy protection is here, and it stays off until you say yes! Setup asks before anything is masked!
standard hides credentials and format-dependent identifiers, and strict also perturbs labeled ages and amounts!
- 📦 2026-09-24 · 0.4.2 — The npm package finally counts
skills/, so a fresh install is no longer an empty box!
- 🔧 2026-09-24 · 0.4.1 — TypeScript compiles again after the rename! v0.4.0 had been tagged, and npm publish had stopped on the leftover name!
- 🏷️ 2026-09-24 · 0.4.0 — The immune metaphor left the building! Skills live in
skills/, attacks live in attacks/, and caitlyn synthesize replaced caitlyn vaccinate!
- 🖼️ 2026-09-02 · 0.3.1 — The terminal logo's right edge finally lines up! Paper credits moved into Acknowledgments!
- 🪄 2026-08-31 · 0.3.0 —
caitlyn setup now walks you through provider, API key, detected agents, and detection depth! Nothing is written until you confirm!
- 📚 2026-08-28 · 0.2.0 — The defense library is on npm! Active skills, research entries, and the papers named below all shipped together!
CAITLYN protects the boundary where an LLM agent consumes webpages, files,
search results, application programming interface responses, user follow-ups,
and Model Context Protocol tool outputs. Its core idea is to represent security
controls as a library of executable skills that can be inspected, tested,
versioned, and extended after deployment.
The repository contains the runnable TypeScript middleware, 39 defense-skill
entries, six attack entries, a terminal interface, agent integrations, the
System II synthesis engine, and the Python evaluation framework used for the
paper experiments.
Install
Node.js 22.19 or newer. One command installs the latest release and puts both
caitlyn and caitlyn-hook on your path. No clone and no source build:
npm install -g caitlyn@latest
caitlyn
For a project-local install:
npm install caitlyn
npx caitlyn status
Use the global command for the terminal interface and agent hooks. Use the
local install when an application imports the scanner and pins the version in
its own package.json.
caitlyn setup then asks for the provider, API key, detected agents, detection
depth, and whether to enable privacy protection. Privacy stays off unless you
turn it on and choose standard or strict. Nothing is written until the
final confirmation. The same flow is /setup in the terminal interface.
Source builds, agent wiring, and the evaluation setup are in
Quick start.
Help us cover more defenses
If you work on agent injection defenses and a method is not yet represented in
CAITLYN, please open an issue with
the paper title, venue, link, and a short description of the threat model and
deployment context. Reference implementations, reproducible code, or a minimal
integration sketch are especially helpful. We review such reports and integrate
suitable methods into the defense library when they fit the runtime model.
Why CAITLYN
Static rules are fast but brittle. Full LLM judges understand context but add
latency and token cost. Offline retraining adapts slowly to attacks that appear
after deployment. CAITLYN separates these concerns into two cooperating
systems:
| Component | Purpose | Mechanism |
|---|
| System I, Tier 0 | Fast runtime gate | Sandboxed TypeScript detection skills |
| System I, Tier 1 | Context-sensitive fallback | Compact LLM status-and-score classification |
| System II | Post-deployment adaptation | Counterexample-guided synthesis, verification, review, and promotion |
System I protects the current request. System II uses observed misses to
improve the defense library for future requests.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
