Overview

Ferrite is a browser for AI agents. It is written in Rust. It is built on the Servo engine. Servo is the web engine Ferrite uses to draw pages. The research part of Ferrite is a defense against indirect prompt injection (IPI). This defense is architectural. That means it works by how the system is built, not by reading text. Ferrite also publishes an evaluation. The evaluation says how well the defense works and where it does not.

New words are explained where they first appear. The full list is on Words we use.

The idea in one minute#

An AI agent that browses reads content it does not control. Some of that content can carry orders aimed at the agent, not at you. This is called an injection: hidden text that tries to give the AI new orders. It can sit in a hidden element, an HTML comment, an image alt attribute, or a field in a tool's JSON answer. Ferrite does not try to recognize every wording of an injected order. That is a race it cannot win. Ferrite watches what the agent does. It works in four steps:

1. Predict the task's expected fingerprint. The fingerprint is the list of tools and websites the task is expected to need. Ferrite works it out from your request alone. It does this before it reads any untrusted content.
2. Dry-run the agent's plan against made-up data. A dry run is a practice run that does nothing real. No real network can be reached during it.
3. Compare what the agent tried with what Ferrite predicted.
4. Consent-gate everything beyond the prediction. A consent gate is a question asked to you before the action runs. It appears in a trusted panel that page content cannot touch. Nothing real runs before you answer.

A successful injection can still make the agent try something unexpected. But trying it in a contained practice run is very different from doing it for real. After the practice run, you meet a consent prompt that you control. Ferrite also keeps an audit log. It uses SHA-256 hashes to tie each entry to the one before it. The log records the security events. So you can check afterward that the defense contained the attack.

What is in the box#

Ferrite is made of several Rust crates. A crate is a package of Rust code. This table lists them.

Where the project stands#

The planned rebuild is done. Every charter ran. Every defect in the tracked list was fixed, or was accepted as intended behavior. The evaluation reports real numbers from a real corpus. Nothing is made up. That does not mean Ferrite has every feature or is ready to trust in production. Ferrite is a research prototype. Limits puts the things to keep in mind on one page. The main ones are:

• The main evaluation uses a scripted agent. So its results describe the architecture, not the behavior of any one model. The owner has also run the live runner with one real model, ollama gemma4:31b. That run covers all 1,984 cases. It tested only one model. That model rarely fell for the attack (2.0%). So the guard had few attacks to stop. Limits has the details.
• The corpus was written by one author and generated from templates. So the confidence intervals are too optimistic.
• Some attacks stay inside the prediction. They use the same capability at the task's own site. They are a residual that the design cannot remove. A residual is an attack that looks exactly like the normal task.
• The newest browser work was checked on Linux under a virtual display. It includes DevTools, page controls and panel resizing. Some of it has run on one Mac (an Apple M1). The build on the releases page is older than most of it.

Where to go next#