4 ms·
A bit more context on why pattern matching instead of ML: 1. Speed: <10ms vs 200-500ms for LLM-based checks means you can scan every user message without addin
by joergmichno 7mo ago
A bit more context on why pattern matching instead of ML:
1. Speed: <10ms vs 200-500ms for LLM-based checks means you can scan every user message without adding latency.
2. Cost: No API calls to OpenAI/Anthropic for detection = predictable costs at scale.
3. Transparency: When a pattern matches, you know exactly which of the 42 patterns triggered and why. No "the model thinks this looks suspicious."
The tradeoff is obvious — patterns can't catch truly novel attacks. But neither can LLMs reliably (they get tricked by the same prompt injections they're supposed to detect).
My goal: catch the 80% of attacks that are copy-pasted from public prompt injection databases, so you can focus your resources on the remaining 20%.
For CI/CD users: the GitHub Action runs ClawGuard on every PR, so you catch injections before they reach production. The Python SDK lets you integrate scanning into your agent pipeline with two lines of code.
Would love to hear from folks running AI agents in production — what's your current detection strategy?