Attackers don't hack your AI.
They just talk to it.
Bordair stops prompt injection across text, files, images and audio - in under 50ms.
Watch Bordair block real attacks in real time.
Crafted prompts, hidden image OCR, document payloads, ultrasonic audio - the same payload set we see in the wild, scanned through the local model with the verdict streamed back in milliseconds.
Think you can outsmart AI security?
Bordair's Castle is a multimodal prompt-injection game. Craft attacks that slip past 5 kingdoms of AI defences, climb the leaderboard, and win prizes. No account needed.
Your AI isn't safe just because
no one has hacked it yet.
These are real attacks happening to real AI products today. Each one looks like a normal message. Each one would silently exfiltrate data, hijack tools, or break your model-if Bordair wasn't in front of it.
Want to know if your AI is actually safe? Book a free pen test and we'll show you exactly where it breaks.
Support bot leaks customer history
Resume PDF hijacks the screening AI
Voicemail tells the agent to wire funds
Bordair sits between your users and your AI. Every message, document, image, and audio clip is scanned in milliseconds - before your model ever sees it.
Built for AI in production.
Every primitive you need to keep an AI product safe-input scanning, output guarding, multimodal coverage-exposed through a single REST API.
Sub-50ms inline scanning
Synchronous detection that actually sits in the request path. No async queues, no polling, no 200ms tax on every prompt.
Multimodal in one call
Text, image, document, and audio scanned together in a single /scan/multi request. Each routed through its own pipeline.
Beyond regex
435M-parameter detection model purpose-built for prompt injection. Catches semantic attacks that pattern matching can't see.
Block, redact, warn
Custom regex rules over LLM output. Stops leaked keys, PII, and sensitive content before it reaches users.
Dual-region, always on
EU (London) + US (Virginia) with Route 53 latency routing. Your traffic auto-hits the nearest edge.
Protect inputs and outputs
Input scanning stops attacks before they reach your LLM. Output scanning lets you define custom regex rules to block, redact, or flag sensitive content in model responses -before they reach your users.
Per-rule actions
Each regex rule gets its own action -block, redact, warn, or log. Block leaked API keys, redact emails, warn on PII, and log everything else.
Custom regex patterns
Define your own patterns to match against LLM output. Catch API keys, credentials, email addresses, phone numbers, or any sensitive content specific to your domain.
Smart redaction
Redact rules replace matched content with [REDACTED] while keeping the rest of the response intact. Multiple redaction patterns work together in a single scan.
Priority-based resolution
When multiple rules match, the highest-priority action wins: block > redact > warn > log. Deterministic behaviour, no surprises.
The full taxonomy of attacks - covered.
From basic instruction overrides to multi-turn escalation, cross-modal smuggling, and adversarial encoding. 18 attack families, continuously updated.
Direct prompt injection
CommonAttempts to override system instructions, change AI behaviour, or bypass safety guidelines through explicit commands in user input.
Indirect prompt injection
GrowingMalicious instructions hidden in external content the AI processes - emails, web pages, API responses, RAG documents, and retrieved context.
Jailbreak attacks
CommonRole-play exploits, DAN prompts, hypothetical framing, and persona hijacking designed to make AI ignore its safety constraints.
System prompt extraction
High riskSocial engineering, translation tricks, encoding games, and formatting exploits aimed at making AI leak its confidential instructions.
Multi-turn escalation
SophisticatedAttacks that build up gradually across multiple messages - Crescendo attacks, context poisoning, and incremental trust manipulation.
Cross-modal attacks
EmergingInjection payloads split across text, images, documents, and audio that only become dangerous when the AI combines them.
Coverage is updated continuously as new attack techniques emerge - informed by Castle, academic research, and production data.
Start protecting your AIPricing
Start free, scale when you need to
No payment required to get started.
Free
For personal projects and prototypes.
- 200 credits/week
- 20 credits/minute
- REST API access
- Image, document & audio scanning
- Dashboard
- Output scanning rules
- Priority routing
- SLA guarantee
Lite
For solo side projects and single-feature AI apps.
- 1,500 credits/week
- 50 credits/minute
- REST API access
- Image, document & audio scanning
- Castle Kingdom 5 unlocked
- +5 magic refilled monthly
- +10 first-upgrade bonus magic
- Email support
- Dashboard
- Output scanning rules
- SLA guarantee
Individual
For solo developers shipping to production.
- 10,000 credits/week
- 100 credits/minute
- REST API access
- Image, document & audio scanning
- Output scanning rules
- +5 magic refilled monthly
- Dashboard
- Email support
- SLA guarantee
Business
For teams with production workloads.
- 100,000 credits/week
- 2,000 credits/minute
- REST API access
- Image, document & audio scanning
- Output scanning rules
- Semantic layer (coming soon)
- +5 magic refilled monthly
- Dashboard
- Priority support
- 99.9% SLA
Enterprise
For large-scale or compliance-sensitive deployments.
- Unlimited credits
- Custom rate limits
- REST API access
- Output scanning rules
- Semantic layer (coming soon)
- Dashboard
- Dedicated support
- Custom SLA
- Custom contracts
Not technical? We'll install it for you.
You don't need a security team. Tell us what your AI does - support bot, document reader, voice agent, internal tool - and one of our engineers will quote a fixed-price install, plug Bordair in, and harden the integration. You stay focused on customers.
Tell us about your AI
A short call (or email) - what it does, where it lives, what data it touches. No jargon required.
We quote a fixed install
No surprise hourly rates. One number, one timeline, one clear scope. Approve and we start.
You go live - protected
We integrate Bordair, test it against real attacks, and hand over a short report. You own the keys.
Get a free pen test of your AI.
We'll run our 503,358-sample v5 dataset against your live endpoint - text, image, document, and audio - and send back a per-category Attack Success Rate report with the top failing payloads. Plus a free month of Business tier to remediate what we find.
Multimodal pen test
Run by us, not by you. We benchmark your API against v5 attacks across every modality - including waveform-level audio tampering and cross-modal payloads that split across channels.
- Per-category Attack Success Rate broken down by modality
- Top 10 failing payloads with reproduction steps
- Remediation suggestions per attack class
- No credit card, no sales call
Business tier included
After the pen test, fix the gaps with a free month of Business - a $99 value. Unlimited multimodal scans, output scanning rules, and priority routing across EU and US regions.
- 100,000 credits / week, 2,000 / minute
- Full multimodal pipeline
- Output scanning rules + allow-lists
- Cancel anytime, no auto-renew surprise
Built by a defender. Stress-tested by attackers.
I'm a cybersecurity professional at a FTSE 100 company - I've spent years watching how attackers operate, how they test boundaries, disguise payloads, and exploit blind spots that defenders never see coming.
When companies started connecting AI to their products without checking what users were sending in, I knew exactly how that story ends. So I built Bordair as an independent side project - on my own time, on my own infrastructure.
The detection system works the way good security should: fast enough that users never notice it, accurate enough that it doesn't cry wolf, and built to handle attacks across text, images, documents, and audio - because real attackers don't stick to one format.
FTSE 100 cybersecurity professional
Engineered under the same security mindset large enterprises operate under: zero tolerance for missed attacks, zero tolerance for false alarms.
Advancing the field. Released for the community.
We're publishing the largest open prompt-injection corpus to date so academics, red teams and other defenders can build on it. 503,358 labeled samples - 251,782 attack + 251,576 benign, balanced 1:1 - covering cross-modal, multi-turn, adversarial suffix, indirect injection, agentic, reasoning DoS, video jailbreak, LoRA supply chain, and more. Sourced from 40+ peer-reviewed papers, CVE reports, and competition datasets.
Test any LLM in 30 seconds
The bordair SDK (Python and Node) ships with a CLI that runs the full dataset against any OpenAI-compatible or Anthropic endpoint. Works with OpenAI, Anthropic, Groq, Together, Ollama, LM Studio, vLLM, and any other compatible API.
pip install bordairnpm install -g bordaircurl -sSL https://bordair.io/install.sh | bashbordair eval \
--url https://api.openai.com/v1/chat/completions \
--key $OPENAI_API_KEY \
--model gpt-4o-mini \
--modality text \
--limit 100 --parallel 10Returns an Attack Success Rate (ASR) table broken down by category, with optional --include-benign to measure false-positive rate. Same bordair package gives you programmatic SDK access too.
What's in the dataset
Five dataset versions (v1-v5) covering 2023-2026 attack research. Every sample carries an academic source attribution, attack category, and expected-detection label. Designed to train robust classifiers against adversarial inputs that evade naive pattern matching.
Contact
Talk to a human
Want a quote, a free pen test, or just to ask whether your setup is at risk? Send a message - it lands directly in our inbox.