At the request boundary, the Repellox interceptor evaluates an agent's assembled input before forwarding it to the LLM. The request is classified first, so an unsafe message cannot enter the reasoning sequence unchecked.
Repellox sits ahead of the agent's normal execution path. Before the LLM receives a token, the interceptor classifies the request and decides whether to forward it. This post covers its position, decision process, and practical output.
The Interceptor's Position
The integration point is important. System-prompt defenses and output filters both act after the model has processed the adversarial content. One tries to detect damage afterward, while the other relies on the model to identify its own compromise.
Repellox checks the request before forwarding it. In a LangChain agent, repellox.wrap() replaces the executor's standard run() method. Each executor call first passes through the Repellox client. If blocked, it never reaches the LLM API.
# Standard LangChain executor
result = agent_executor.run(user_input)
# With Repellox
protected = repellox.wrap(agent_executor, api_key=API_KEY)
result = protected.run(user_input)
# If user_input contains adversarial content, the LLM call never fires.
This is code-level wrapping at the agent execution boundary, not a network proxy. The added latency comes from classification rather than a network hop.
What the Classifier Checks
The classifier receives the full context headed to the LLM: system prompt, conversation history, retrieved documents when applicable, and the new user message. It analyzes that context for adversarial instruction patterns.
Early-access testing shows three main block categories. Direct injection asks to override the system prompt, for example, "ignore all previous instructions and do the following." Jailbreaks use roleplay, encoded payloads, or escalating hypotheticals to bypass restrictions. Indirect injection places hostile instructions inside a retrieved document the agent uses during reasoning. We cover that case in a separate post.
The classifier assigns each request a confidence score. Thresholds vary by deployment, so we do not publish fixed values. For production, we recommend blocking high-confidence cases, sending mid-range cases for human review, and passing clean inputs with an audit entry.
How Blocking Works
A block is an explicit failure, not a silent one. The interceptor returns a structured exception to the calling code instead of an LLM response, and the agent must handle it. We do not hide probes behind a fabricated safe reply.
try:
result = protected.run(user_input)
except repellox.InjectionBlocked as e:
print(e.threat_class) # e.g. "prompt_injection.direct"
print(e.confidence) # e.g. 0.94
print(e.inspection_id) # UUID for audit trail
# Return an error to the user, log the event, alert security team
The inspection_id connects the block to its audit record. Query that ID through the Repellox API to retrieve the inspection details, including the triggering pattern and the context assembled during classification.
Inside the Audit Record
Every intercepted request, whether allowed or blocked, creates an audit entry. In private beta, teams valued this visibility as much as the blocking because it showed what their agents actually received in production.
A log entry normally records the timestamp, inspection ID, request hash, threat result, confidence score, agent identifier, and forwarding decision. Raw input is excluded by default for privacy, but input logging can be enabled for forensic review.
{
"ts": "2026-07-19T14:22:11Z",
"inspection_id": "insp_7kR4mNx2pQ",
"decision": "BLOCKED",
"threat_class": "prompt_injection.direct",
"confidence": 0.94,
"agent_id": "customer-support-agent-v2",
"session_id": "sess_8bV3nYp1",
"request_hash": "sha256:a9f3c2..."
}
Adapting to Agent Context
The default classifier uses a broad corpus of injection patterns, jailbreak methods, and adversarial LLM payloads. Most agents need no configuration. Unusual system prompts, domain-specific formats, or retrieval content can still cause false positives.
False positives are expected, especially with structured text such as code, JSON, or commands that resemble injection patterns. Review mode flags the request instead of blocking it, then lets you inspect the record, confirm the threat, or mark legitimate input for retraining. That feedback calibrates the classifier to the agent's context.
Scope and Limits
The interceptor evaluates input at the request boundary. It does not inspect isolated tool output from an external API. If a retrieved document contains an injected instruction, it is caught when added to the LLM's reasoning context. It is not caught when tool output goes directly to the user without LLM processing.
The interceptor also does not replace authorization inside your tools. Database access controls remain your responsibility when a tool can write data. Repellox helps stop manipulation that would trigger the call, while defense in depth remains necessary throughout the stack.
The quickstart docs show LangChain and OpenAI Agents SDK integration in about five minutes. The audit log begins recording with the first request.