I built a leak scanner, then measured exactly where it fails. Here's both.

The scary 2026 stat isn't the 340% surge in prompt injection or the 88% of orgs

reporting agent incidents (OWASP-linked, Beam AI). It's this: the leak

is often not in the answer your logs capture — it's in the model's reasoning, which

most people never scan. A 2026 benchmark found data escaping through reasoning/logs

while the visible output stayed clean in most scenarios (AgentLeak).

And the cost is not abstract. A stolen Gemini key burned $82,314 in 48 hours for a

three-person startup this year — 457× their normal bill, with the provider's

shared-responsibility model leaving them to pay it, and it kept happening to devs

worldwide through mid-2026 (The Register, Cybernews). If personal data leaks,

add the legal bill: GDPR fined Meta €251M for a token-exposure security failure, and

the EU AI Act stacks up to 7% of global turnover on top (DPO Europe). Yet ~88% of

orgs had an agent incident this year while ~82% thought they were covered (Beam AI).

Confidence isn't coverage — and the people getting hit assumed "it's just a token."

I measured a deterministic slice of this on four indie-common models. The matcher

held steady across formats, languages, and multi-turn attacks — zero misses where a

literal secret surfaced, zero false positives on known families. The reasoning

channel leaked more than the answer. And hardening the answer didn't secure the

reasoning.

Then the honest part: outside its known families it catches nothing (I published the

0-of-10 test before expanding), it's literal-not-semantic, offline-not-runtime, and

tested on small models. It's one layer, not a fix — prompt injection is still

unsolved industry-wide. I publish exactly where it works and where it doesn't;

raw stays private, aggregates public.

[https://github.com/ghkfuddl1327-wq/agentproof]

[https://github.com/ghkfuddl1327-wq]