Prompt injection firewalls for AI APIs are taking several forms: prompt inspection before a model receives a request, local security decisions governed by application policy, and network mediation around agent activity. Fastly, Cloudflare, JevShield, Pipelock and Palo Alto Networks’ Prisma AIRS illustrate those different approaches. Their documented capabilities address different parts of an AI system, making the placement and scope of each control central to any comparison.
Fastly’s introduction of AI Firewall, AI Runtime Control and additional API Security capabilities, reported by Security Today on September 24, 2026, provides a concrete example of this expansion. The offering separates malicious-prompt inspection, model-access management and enforcement of API rules.
The available documentation supports an architectural comparison, but does not establish a detection-performance winner. The capabilities below are vendor or project descriptions, rather than results from a common independent test.
Where each control operates
Prompt injection attempts to redirect an AI application’s behavior through instructions that subvert its intended operation. JevShield’s project materials distinguish direct attempts to override application instructions from indirect attacks embedded in external content, including documents, retrieval results and tool outputs. That distinction makes the inspection point consequential: an incoming prompt and content returned during an agent’s work are different surfaces.
| Offering | Documented control point or focus | Qualification that matters |
|---|---|---|
| Fastly AI Firewall | Evaluates prompts before they reach targeted models | Runtime management and API-rule enforcement are described as separate capabilities |
| Cloudflare AI Security for Apps | Inspects incoming prompts at labeled application endpoints | Detection handles <code>application/json</code> requests; detection fields require an Enterprise paid add-on |
| JevShield | Local security inference followed by a Python policy engine | Research and demonstration project; demo tools are simulated |
| Pipelock | Mediates agent traffic across HTTP, WebSocket, MCP and A2A | Visibility depends on routing and interception configuration |
| Prisma AIRS | Detects and alerts on malicious AI traffic, with unified security-event viewing | The cited network-intercept licensing limit is per vCPU per day |
These are overlapping security approaches, with distinct deployment implications. For an evaluator, the first question is which traffic or decisions a proposed control will actually inspect.
Fastly separates prompt inspection from runtime management
According to Security Today’s report, Fastly says AI Firewall is designed to detect and block attacks against large language models, including prompt injection. It evaluates prompts before they reach the targeted model.
AI Runtime Control provides a central endpoint for requests to public and self-hosted providers. Its described functions include virtual keys to protect provider credentials, spending tracking, usage limits, budget controls and failover support. Those functions govern model access and consumption; the report assigns malicious-prompt inspection to AI Firewall.
The accompanying API Security capabilities apply rules to requests from both AI agents and conventional applications. Organizations can review or block requests that violate established API rules, including incorrectly formatted requests or attempts to invoke unsupported operations.
The useful distinction is between interpreting a prompt as potentially hostile and checking whether an API request conforms to the interface’s rules. Fastly’s announcement describes controls for both, without providing a shared benchmark for their effectiveness.
Cloudflare adds AI detections to application security
Cloudflare’s documentation describes AI Security for Apps, formerly Firewall for AI, as a complement to existing web application firewall rules. It identifies personally identifiable information in incoming prompts, detects unsafe or organization-defined topics, and detects prompt injection attempts such as instructions to ignore the model’s rules or reveal its system prompt.
Cloudflare describes the detections as model-agnostic. Their documented request scope is specific: when enabled, the service scans incoming requests to endpoints labeled cf-llm, and detection currently handles only requests with the JSON content type application/json.
Availability also separates discovery from inspection. LLM endpoint discovery is listed across Free, Pro, Business and Enterprise plans. The AI Security Log Mode Ruleset and AI detection fields are listed as paid add-ons for Enterprise, with customers directed to their account team for access. The Log Mode Ruleset records the full request body alongside detection results.
Endpoint discovery therefore should not be read as access to prompt injection scoring. Teams evaluating the service need to match both their request format and their plan to the documented detection requirements.
JevShield makes policy explicit after local inference
JevShield’s repository describes a local, open-source security layer using Ollama’s Jev-style decision models and Nimble. It produces structured security decisions and risk scores, which pass to a deterministic Python policy engine for the final decision. The project says security inference runs locally without sending security data to a cloud API.
Its policy blocks when the maximum normalized risk is at least 0.85, requests review at 0.50 or above, and otherwise allows. It also describes fail-closed behavior for privileged operations and prohibits a model-generated response from directly authorizing such an operation.
The architectural distinction is the separation between a model’s assessment and the application’s authorization policy. Deterministic enforcement makes the response to a score explicit; it does not make the underlying detection certain. JevShield itself describes prompt injection detection as probabilistic and disclaims protection against every technique.
Its untrusted-content tracking also preserves a distinction between recognizing suspicious text and granting that text authority: tainted content remains data and does not authorize tools. The materials explicitly note that a non-safe threat classification can still result in an allow decision.
JevShield is a research and demonstration project. Its demo tools simulate actions rather than sending real email, destroying files or executing shell commands. Its benchmark includes synthetic attacks and benign requests and measures classification quality and latency, but that description does not establish comparative production performance.
Pipelock focuses on mediated agent traffic
The Pipelock materials carried by Kitploit describe an open-source firewall positioned between AI agents and the network. It scans mediated outbound and inbound traffic for threats including secret exfiltration, prompt injection, server-side request forgery, tool poisoning and risky tool-call chains.
The described coverage includes HTTP, WebSocket, MCP and A2A traffic. CONNECT tunnel contents are inspected when TLS interception is enabled; plain CONNECT without interception is scanned at the hostname and URL level. Configured MCP upstreams are an exception to private-address blocking: local and private servers are allowed, while cloud metadata endpoints remain blocked.
Deployment can use a proxy, MCP wrapper, sandbox, host containment model or cluster topology. In each case, routing the agent through the boundary determines what Pipelock mediates.
Pipelock also emits signed action receipts that reviewers can verify offline with a key they hold. These receipts document mediated decisions. The materials explicitly limit what they prove: they do not establish what happened outside the mediated boundary. That makes auditability a separate property from detection coverage.
Prisma AIRS makes visibility and capacity part of the comparison
Palo Alto Networks’ documentation describes Prisma AIRS detection and alerting for malicious traffic, with a Log Viewer that unifies network-based and API-based AI security events. The cited page includes prompt injection among its threat categories.
It also states a licensing capacity limit of up to 10,000 AI transactions per day per vCPU of AI network intercept. That is a licensing limit for the documented deployment context, rather than a detection-accuracy result or a general throughput benchmark for every Prisma AIRS mode.
For platform teams, this adds operational questions to the architectural comparison: where security events can be reviewed, which deployment mode applies, and how transaction volume relates to licensed capacity.
Evaluate the boundary before the score
The evidence supports comparing inspection points, policy behavior, deployment prerequisites and audit records. It does not support ranking these products by detection accuracy, false-positive rate or added latency under equivalent conditions.
A useful evaluation would therefore map each documented control to the application’s actual traffic path, then test the relevant attacks and benign requests under that configuration. JevShield’s explicit policy, Cloudflare’s request-format restriction, Pipelock’s interception boundary and Prisma AIRS’ capacity qualification all show why a feature name alone leaves essential questions unanswered. The practical value of a prompt injection firewall depends on the decisions it can observe and enforce within the system being protected.
