# Thermus and prompt injection

Updated: 2026-10-15

Thermus fetches and cleans public webpages before they reach an AI agent. It protects the web traffic routed through its MCP gateway; it does not inspect every source of instructions an agent might encounter.

## How a web request works

Your data and agents sit on one side. Agents connect to your data through MCP servers and connectors:

Data lake: financial, sales, marketing and employee data

Internal systems: email, CRM, ERP, messaging and code repositories

Agents: built in ChatGPT, Claude, Agentforce, Lovable and more

The web sits on the other side: HTTP or HTTPS pages fetched with GET. The current tool has no POST upload or built-in search operation; the client supplies the URL.

Thermus sits between the agents and the web. Each request takes four steps:

URL and reason. The agent sends a webpage URL and reason to Thermus over MCP. The reason is recorded, not scored.

Authorized fetch. Thermus checks product access and input limits, then fetches the URL.

Raw page. The website returns raw, untrusted content to Thermus.

Clean markdown. Thermus cleans the content and returns plain markdown to the agent.

## Cleaning inbound content

Renders the page on Thermus's side.

Strips ads and invisible content, including white-on-white text and text too small to read. That's where injected instructions often hide, because people would notice them otherwise.

Returns only clean markdown to the model.

## Does Thermus stop all prompt injection?

No. Thermus filters hidden page content before returning Markdown. Visible malicious instructions can remain. The current GET-only tool records the reason without scoring it and supplies no POST uploads or human approval steps.

It cannot stop a leak through a route that bypasses the gateway, such as an enabled email-sending action, a Power Automate flow, or another tool with independent outbound access. Those routes need separate controls. When approved connectors have appropriately scoped identities, resources and actions, with unnecessary outbound actions disabled and necessary ones separately governed, Thermus cleans webpages fetched through its gateway. It does not assess whether a GET URL discloses sensitive information. The connectors need not all be read-only, but their permissions and output boundaries must be enforced separately.

It does not sit between the agent and its model or inspect calls to the LLM provider. It identifies itself as a bot and does not bypass websites that block bots.

## Lower token costs

Agents that read the web through Thermus get clean markdown instead of full pages, and markdown is far smaller. In Cloudflare's published example (Markdown for Agents, February 2026), a page that took 16,180 tokens as HTML took 3,150 as markdown, about 80% fewer. Your savings depend on the pages your agents read. [Cloudflare Markdown for Agents example](https://blog.cloudflare.com/markdown-for-agents/)

## Related topics

- [Outbound request checks and data leaks](https://thermus.ai/guide/data-leaks.md)
- [Deployment and bypass checks](https://thermus.ai/guide/deployment.md)