Every company deploying a public-facing LLM chatbot inherits the full prompt-injection attack surface: jailbreaks, data exfiltration, PII leakage, indirect injection via retrieved documents. Single-model classifiers and regex filters consistently miss novel attacks, the same way single-AV products missed novel malware a decade ago.

This talk presents an open-source defensive architecture that runs five specialist AI agents in parallel against every prompt and response, each looking at a different attack dimension (injection patterns, semantic intent, encoding tricks, output exfiltration, PII exposure) and aggregates their verdicts before the request reaches the upstream LLM. We'll walk through the architecture, show live attacks bypassing commercial single-model guardrails but caught by the multi-agent pipeline, and discuss the latency/cost tradeoffs that make this practical as inline middleware.