Pipelock publishes what it cannot catch. A security control that claims full coverage is the one to distrust, and a reviewer needs the boundaries drawn to decide what residual risk is acceptable. This page is the standing register. It tracks the documented gaps and, per release, the false-positive and true-positive picture.
The authoritative engineering source is the bypass resistance doc, which lists the evasion techniques Pipelock handles alongside the ones it does not. This page is the operator-facing summary.
Out of scope
These are outside what a network and tool proxy can see. If your threat model includes them, you need an additional control, named in the mitigation column.
| Limitation | Why | Mitigation |
|---|---|---|
| Process-level attacks | Pipelock mediates traffic, it does not isolate the process. An agent that can exec arbitrary processes can open a channel that never touches the proxy. | Pair with an OS sandbox (Docker, gVisor, Firecracker) and containment. |
| Non-HTTP exfiltration | A write to a cloud-synced folder, the clipboard, stdout, or a subprocess that does not use the proxy never reaches Pipelock. | Container network isolation so the only egress path is the proxy. |
| Model compromise | If the model itself is fine-tuned to be malicious, Pipelock cannot read intent. It sees the network-visible symptoms, not the motive. | Defense in depth across the four functions. |
| Pixel-level steganography | Data hidden in image pixels or audio or video sample bits is beyond content inspection. Pipelock strips EXIF, XMP, IPTC, and ICC metadata, so metadata-based steganography is covered, but pixel-level encoding is not. | Specialized media analysis if your threat model needs it. |
| Covert channels | Timing, header ordering, and HTTP/2 frame flags carry bits outside the URL and body content layer. Detecting them needs protocol-level analysis beyond content inspection. | Documented gap. Containment limits the reachable channels. |
Partial coverage
These are mediated but not absolute. Pipelock reduces the risk without closing it.
| Limitation | Detail | Mitigation |
|---|---|---|
| Semantic prompt injection | Injection detection is pattern-based, so it is syntactic, not semantic. An injection crafted to match no known pattern can pass. | Add custom patterns for your domain. Treat detection as one of four functions, not the whole defense. |
| Very slow exfiltration | A drip of one byte per hour over days sits below any practical rate limit or entropy threshold. | Container isolation prevents it. Without isolation, this is the residual risk. |
| Misconfiguration | Audit mode logs without blocking. An operator who never switches to balanced or strict enforces nothing. | Start in balanced mode. Use pipelock audit to generate a tuned config. |
| IPv6 reachability | If the internal CIDR list omits IPv6 ranges, an agent could reach internal services over IPv6. | The default config includes the standard IPv6 private and multicast ranges and strips zone IDs before parsing. |
| Unintercepted CONNECT | On a plain HTTPS CONNECT tunnel without TLS interception, only the destination host is visible, not the path, body, or response. | Enable TLS interception for full content coverage on CONNECT traffic. |
False-positive and true-positive rates
Detection quality is a moving target, so it gets reported, not asserted. The measurement source is the public agent egress benchmark: a tool-neutral corpus of attack and benign cases scored by an open runner, plus Pipelock’s in-repo evasion test suite for the encoding and Unicode classes.
When a benchmark run is recorded, the measured figures are published here: the benign-traffic false-positive rate and the attack-corpus true-positive (catch) rate, with the corpus version and date. The numbers always come from a real run, never an estimate, and they are not posted on a fixed per-release schedule. Between updates, the benchmark repo holds the current public corpus and runner, so anyone can reproduce the score independently.
No measured snapshot has been recorded here yet.
Where to go next
- What Pipelock claims and does not claim for the doctrine behind this register
- Defining the agent security category for the four functions these gaps map to
- Bypass resistance (engineering source) for the technique-by-technique detail