Our new model performs like GPT-5 on AgentHarm, but 5X faster.
Until today, guardrails had to choose between smart and fast.
The default is classifiers on the hot path, which have no context on the system prompt / the rest of the conversation (they often read just the last message) and can't follow complex reasoning.
This has led to the guardrail industry's consistent failures: too many overblocks, or not enough protection.
The solution would of course be to use LLMs, smart enough to make thoughtful decisions. But they are too slow to sit in the hot path. Too much latency!
With Sage from
@LevantoLabs, which is built by fusing LLM and classifier capabilities, for the first time you can have something with the intelligence of an LLM... as a guardrail.
Sage answers in 200ms (86ms + network time), 5X faster than GPT-5 with reasoning=minimal (19X faster if GPT-5 has reasoning=low).
All this in a generalized way, without requiring domain-specific training (as often done with classifiers).
This is a breakthrough for agentic security that changes the safety-utility equilibrium that guardrails will achieve in the coming years.
Why did we pick AgentHarm? The field is full of prompt-injection and jailbreak benchmarks based on judging static strings:
– they are basically all saturated, because classifiers put them in their training sets
– they are not interactive and don't consider the "unguarded" scenario
AgentHarm, developed by the UK
@AISecurityInst and
@GraySwanAI (Andriushchenko et al., ICLR 2025), gives a real tool-using agent multi-step malicious tasks and scores how much harmful work actually gets completed. We ran its public test split: 176 harmful + 176 matched benign scenarios, comparing an unguarded model (without any guardrail) against the same model under different protections.
Conversations happen live and are not deterministic, so they change on every run.
As the unguarded baseline, we kept the paper's original model: GPT-4o, which prevents 51% of harmful work while allowing 100% of the harmless requests. Sage takes that to 77% harmful work prevented, while allowing 95.5% of harmless requests. GPT-5 sits at 76% / 96%.
@Google Model Armor stops more harm than we do (90%), but it blocks 1 in 8 harmless requests. That's not a guardrail, that's an outage with a policy attached.
Below👇is a reproducibility guide you can use to fact-check and reproduce the chart. One caveat stated upfront: thresholds are calibrated at ≤5% FPR on the same benign split we evaluate on: that's in the guide too, with everything else.
We are already talking with many security and guardrail companies about how to upgrade their stack to this new equilibrium between Safety (stop harmful) and Utility (low overblocks).
Please reach out for feedback and collaborations :)