What an agent can match

Every record on PromptIntel comes down to indicators: things an agent or a tool can match without having to judge. They come in two families.

IoPC: Indicators of Prompt Compromise

What only an agent meets.

• Prompt: matched by its NOVA rule, or as the exact text of a known sample. Never expires.
• Agent file: matched by SHA-256, with the file's role (SKILL.md, AGENTS.md, CLAUDE.md, an MCP config, a session history). Never expires.
• Skill: matched by name and registry, until the registry removes it.
• MCP server: matched by name, package or endpoint, until the registry removes it.

IOC: classic indicators of compromise

Attached to the same records: URL, domain, IP address, SHA-256, package, repository, publisher, file path, email, crypto wallet, extension, messaging channel. Network indicators are enforced for a set time after they were last seen, then only logged, then kept as history. A shared platform is never blocked as a whole: a link on a code host blocks that path only.

From detection to response

A NOVA rule or an indicator detects, outside the model. The agent's own policy decides: block, warn, log or ask for approval. The agent responds. PromptIntel distributes the threat intelligence and the NOVA rules; the NOVA rule engine evaluates content where the agent runs; NovaHunting adds runtime visibility, investigation and enterprise enforcement.

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service