LlamaFirewall
Overview
Product details compiled from public sources, each with a citation.
Matrix Coverage
Where this product defends, by asset class and NIST CSF function. The Coverage column shows whether each asset is Primary, Secondary, or Adjacent to what the product does. The table omits empty rows and columns.
| Asset class | Protect | Detect | Coverage | Source |
|---|---|---|---|---|
| AI-Generated Code | Protect: Not covered | Secondary | 2 | |
| Runtime AI Data | Primary | 2 |
Framework Relevance
These frameworks include controls relevant to the asset classes LlamaFirewall defends. This is an editorial inference from the AI Defense Matrix asset-level crossmap, not a statement that Meta implements these controls or is certified against them.
Expand Collapse
| Framework | Asset class | Relevant controls |
|---|---|---|
| NIST IR 8596 | Runtime AI Data | Prompts (runtime); inference data |
| CSA AI Controls Matrix | AI-Generated Code | Application and Interface Security; Supply Chain Management |
| Runtime AI Data | Data Security and Privacy Lifecycle Management; Application and Interface Security | |
| ISO 42001 | AI-Generated Code | A.6 AI system life cycle |
| Runtime AI Data | A.7 Data for AI systems; A.8 Information for interested parties | |
| Google SAIF | AI-Generated Code | Secure the AI pipeline; code provenance and supply chain integrity |
| Runtime AI Data | Expand AI red-teaming; runtime input and output safety; prompt defense | |
| SANS Critical AI Security Guidelines | AI-Generated Code | Model I/O Handling (AI deployment in IDEs: prefer local-only integrations to limit exposure of code, keys, and proprietary data); Governance, Risk, Compliance (regularly test and red-team AI applications before and after deployment) |
| Runtime AI Data | Model I/O Handling (sanitize, validate, and filter inputs and outputs; segregate user and system prompts; multilayered prompt-injection defense); Conventional Security Controls (protect augmentation and RAG data with vector-store access controls and validation); Data Minimization and Obfuscation (limit sensitive prompt content; context-window management); Limit Model Behavior (AI guardrails) | |
| MITRE ATLAS | AI-Generated Code | AML.T0010 AI Supply Chain Compromise (hallucinated dependencies and slopsquatting); AML.T0018 Manipulate AI Model (when models embed code-execution backdoors) |
| Runtime AI Data | AML.T0051 LLM Prompt Injection; AML.T0054 LLM Jailbreak; AML.T0056 Extract LLM System Prompt | |
| OWASP AI Exchange | AI-Generated Code | Development-time threats: insecure code generation, license risk, hallucinated dependencies |
| Runtime AI Data | Input threats: prompt injection, adversarial inputs, evasion; runtime threats: RAG poisoning, memory tampering | |
| OWASP LLM Top 10 | AI-Generated Code | LLM06 Excessive Agency (code execution); insecure or vulnerable code patterns inherited from training data |
| Runtime AI Data | LLM01 Prompt Injection; LLM02 Sensitive Information Disclosure; LLM08 Vector and Embedding Weaknesses; LLM05 Improper Output Handling | |
| OWASP Agentic Security Top 10 | AI-Generated Code | ASI05 Unexpected Code Execution (RCE); ASI04 Agentic Supply Chain Vulnerabilities (hallucinated dependencies and vibe-coding artifacts) |
| Runtime AI Data | ASI06 Memory & Context Poisoning; ASI01 Agent Goal Hijack (via prompt injection in runtime inputs) |
Provenance
Last sourced 2026-06-10.
Expand Collapse
Sources
- PurpleLlama repository on GitHub
- LlamaFirewall README in the PurpleLlama repository
- “LlamaFirewall is a framework designed to detect and mitigate AI centric security risks, supporting multiple layers of inputs and outputs, such as typical LLM chat and more advanced multi-step agentic operations.”
- “A static analysis engine that examines LLM-generated code for security issues in real time.”
- LlamaFirewall documentation site
Changelog
-
Added to the catalog from the Meta LlamaFirewall documentation.
Found an error? Corrections are welcome. Suggest an edit.