Aicrest is designed to reduce the impact of prompt injection attempts in everyday AI companion conversations.
Prompt injection is when a user, webpage, memory, or other text tries to override the app’s instructions. For example, it may ask the model to ignore previous rules, reveal hidden prompts, dump memory, expose logs, or send data somewhere else. Aicrest treats this kind of text as untrusted input.
Before a user message enters the conversation flow, Aicrest checks it for prompt injection risk. If the message looks unsafe, Aicrest blocks it and does not use it to generate a companion response. The exact detection logic is intentionally not published, because publishing those details would make it easier to design bypass attempts.
Aicrest also limits what a language model can do. The local companion model is used to generate text responses from the conversation, the companion profile, user profile, diary, recent messages, selected memories, and app-supplied context such as weather, news headlines, Wikipedia summaries, URL titles, or media descriptions when the user has enabled the relevant consent. It is not given an open-ended tool interface that can browse the web, send email, call APIs, access contacts, or upload your data to arbitrary destinations.
Context is deliberately scoped. Aicrest does not place raw application logs into the response-generation context, so asking the companion to reveal logs should not expose log data.
Aicrest further keeps response generation bounded. Recent chat history is limited, memory context is capped, and external context is included only when relevant features are enabled and the app supplies that context itself. Long-term memories are summarized conversation records, not unrestricted access to every internal app detail.
This does not mean a language model can never repeat information that appears in its prompt. If someone persuades the companion to reveal extra context, that context should be limited to data already available to the user, Aicrest-specific prompt/context text, or public information the app added for a better response. Prompt injection should not give the model a new ability to access private logs, call hidden tools, or transmit user data to an arbitrary internet endpoint.
In short, Aicrest’s protection comes from multiple layers: detecting suspicious messages early, limiting the model to text generation, scoping the data included in prompts, requiring consent for optional external context, and avoiding open-ended tool access from the companion model.









