HisnLabs has put a live demo of Guardrino-t7 Open on its website, in which the classifier runs inside the visitor's browser [1]. The model itself, an earlier and superseded version of the classifier in Guardrino, is public on Hugging Face under the Apache-2.0 licence [2]. The company also states that a sixth version of its internal models is in training and that it has no results for it yet [3].
Background
Prompt injection is ranked number one, LLM01, in the OWASP Top 10 for LLM applications, 2025 edition. OWASP describes it as user prompts that alter a model's behaviour or output in unintended ways, and notes that it can also arrive through external content such as websites or files [4]. Guardrino-t7 Open scores a single message for prompt injection and jailbreak attempts in English, Arabic and Arabizi, which is Arabic typed in Latin letters and digits [2].
What HisnLabs describes
According to the demo page, the model and its tokenizer are downloaded once from HisnLabs' server, about 118 MB for the model file, and are then kept in the browser. The model runs in WebAssembly through onnxruntime-web, and the text typed into the page is not sent anywhere [1]. Each downloaded file is checked against its published checksum before use, and an advanced mode exposes the threshold, a system prompt, a simple policy and batch checks [3].
The model card reports results with 95-in-100 intervals computed by family, so that copies and translations of one attack are not counted as independent tests. At the operating point where about 1 in 100 harmless test messages is flagged, the card reports 44.8 per cent of English attacks caught (41.9 to 47.9), 69.2 per cent in Arabic script and 29.5 per cent in naturally written Arabizi (14.0 to 44.9), the last figure resting on 71 attacks [2].
In an accompanying article, HisnLabs describes problems found in its own review. Its internal report on a fifth version had overstated the gain, and its models read only the first 256 tokens of a message, so an attack placed at the end of a long text can go unread. The demo now reads long messages in overlapping windows by default and says so under its verdict. Version 6 is trained on more attacks from public red-teaming collections whose licences allow commercial training, more harmless Arabic from several dialects, attacks hidden in longer text and held-out sources for testing [3].
Implications for organisations
Teams that run or plan AI assistants for Arabic-speaking users can use the demo to see how one open classifier treats their own sample messages, including dialect and Arabizi, without sending those messages to a server [1]. The demo shows an earlier model with documented weaknesses; it is not Guardrino, which remains in development and is available only through a pilot programme [5].
Recommendations
- Test any guardrail on your own everyday Arabic, Arabizi and English messages, and count wrongly blocked messages as carefully as missed attacks.
- Check how a guardrail handles long documents and pasted text, not only short chat messages.
- Read the model card’s limits before relying on an open model, and do not rely on it alone.
- Companies that want to try Guardrino on their own traffic can request a place in the pilot programme on the product page.
Relevance to FireAI
FireAI and Guardrino work at different layers. FireAI is a network firewall for one Mac: it recognises AI agents such as Claude Code and Cursor, learns where each normally connects and flags a new destination for the user's review, without reading the content of the traffic [6]. It does not read prompts or detect prompt injection in text. Guardrino-t7 Open and Guardrino work on the text of the messages themselves.
Limitations
The figures above come from HisnLabs' own model card and have not been reproduced independently. Most of the test data is translated, written by language models or converted by rules. The open model reads one message at a time, is not a content-safety model and was not trained on French or any language other than Arabic and English. No results exist yet for version 6 [2] [3].
Companies interested in the pilot can request early access to Guardrino, by HisnLabs. Mac users can try FireAI, by HisnLabs free for 17 days.