Subtext: Catch Hidden Prompt Injection

PROBLEM AI coding agents read everything in a repo: READMEs, comments, issues and config files. More developers now hand a stranger's repo straight to their agent without checking it. Attackers exploit this by hiding instructions where humans never look: HTML comments, zero-width characters, base64 blobs or .cursorrules files. GitHub renders the page clean, but the agent still reads every byte and obeys. Prompt injection is the #1 risk on the OWASP Top 10 for LLM Apps (LLM01:2025), and it is already happening: in June 2026, Mozilla 0DIN showed a single cloned repo was enough to make Claude Code open a reverse shell. SOLUTION Subtext is a gate that runs before the agent reads a repo. Every file passes five checkpoints: the repo is opened read-only and nothing is executed; IBM Bob's custom Security Gate mode treats repo text as data, never as orders; 11 rules scan each file in under a millisecond; flagged lines go to IBM Granite Guardian, live on IBM watsonx, for a context-aware second opinion; and each repo gets a SAFE, REVIEW or BLOCK verdict with file and line for every finding. BLOCK isn't the end: Clean copy replaces hidden instructions with a marker, leaves the rest of the file untouched, and rescans it. Our poisoned demo repo goes from BLOCK 90/100 to SAFE 0/100. TARGET USERS AND HOW THEY USE IT - Developers paste a file or any public GitHub URL at subtext-sable.vercel.app, then hand their agent the clean copy. Nothing is cloned or stored. - Maintainers run the CLI in CI. A BLOCK exits with code 2, so a pull request that hides instructions fails before it is merged. - Security teams get a per-repo report of exactly what their agents would have read. - Bob users switch to Security Gate mode, which has no write access and only hands off to Agent mode when the repo is SAFE. WHAT MAKES IT UNIQUE Most tools scan for secrets or vulnerable code. Subtext scans for text aimed at the agent. It makes the AI assistant itself the gate instead of the target, and goes beyond detection by giving back a clean, rescanned copy. Granite adds context: a harmless note asking the AI to use pnpm is flagged REVIEW by the rules, and Granite judges it as no injection. RESULTS On our own labelled set of 40 files (20 malicious, 20 tricky benign such as .env docs, ssh-keygen and emoji ZWJ): 85% detection, 0% false positives, 92.5% accuracy, ~0.5 ms per file. Six popular public repos (express, axios, requests, got, chalk, nvm) were not blocked. 165 tests pass. We are open about the gap: the 3 misses are plain-prose instructions with no hidden wrapper, and sending unflagged prose to Granite is our next step. EFFICIENT BY DESIGN Rules run first because they are fast, free and explainable. Only flagged snippets, capped and cached, are sent to Granite, so model cost stays low. If the model is unavailable, the site falls back to a labelled cached judge.