Prompt-Injection Signals: A Tripwire for Agent Inputs
Part of Security rules.
Prompt-injection signals looks for common signs that incoming text is trying to direct an AI assistant. It is a tripwire, not protection. Paraphrased, translated, misspelled, encoded, or split instructions are not detected, and no finding does not mean the content was safe. A finding means look at this content: it does not show that the agent was compromised, and it did not prevent anything, because the model may already have seen the text. To limit what a compromised agent could do, use outgoing-content rules, approved destinations, and tool restrictions; those are the controls that matter if an injection works.
It is available only when your deployment administrator has opened both the detector library and prompt-injection detection. It applies only to Incoming messages and Returned tool results, and it is Monitor only: Block is rejected when you save a draft and again when you publish. Blocking incoming content cannot keep it from the model, and a rule that stops the agent on a heuristic would let anyone who can send the agent content stop it.
A rule looks for six families of signal:
| Family | What it looks for | What it cannot see |
|---|---|---|
| Instruction override | "Ignore all previous instructions", "you are now in developer mode", "reveal your system prompt" | Paraphrases and other languages; text that discusses these phrases matches too |
| Role or system impersonation | Chat-template control tokens, System: or Developer: at the start of a line, system tags, "this message is from the system administrator" | Role labels are common in logs and documentation, so this family is weak alone; three or more labelled lines are treated as a transcript and ignored |
| Tool-call lookalike | Function-call markup and tool-call JSON | Strong only in returned tool results; a tool that legitimately returns such JSON will match |
| Hidden text | Unicode tag characters (an invisible message, which is read and scanned), long runs of zero-width characters, bidirectional override characters; where the content still has HTML, hidden styling or comments that contain an instruction | Styling and comments need HTML in the content (see below) |
| Data-leaking markup | Images or resource tags whose address carries a long query or a fill-in placeholder | Tracking pixels in marketing email look the same, so a long query alone does not count toward the threshold; addresses signed by a storage service are skipped |
| Directive addressed to an AI | "If you are an AI assistant", "when summarizing this page", "do not tell the user", "send the conversation history" | Ordinary requests worded as instructions |
By default a rule matches when two different families appear, or when a strong signal appears alone (an invisible Unicode tag-character message, a chat-template control token, or tool-call markup in a returned tool result). You can choose which families count, require from one to six families, or turn the strong-signal shortcut off. One family is noisy: with it, ordinary mail and pages match often.
What the content looks like depends on the tool. The platform's web page reader returns Markdown, so styling, comments, scripts and images are gone and only the invisible-character signals can fire on pages it reads. Raw HTTP responses (http_request), results from connected tools, and the HTML of an email keep their markup, so every signal can apply. The detector reads the same normalized copy as identifier detectors (fullwidth letters, zero-width characters, non-breaking spaces and mixed case do not hide a phrase), decodes JSON string escapes in a response, and can read two adjacent fields as one phrase.
Not claimed: paraphrases, other languages (German and Spanish versions of the phrases were tested and missed), lookalike letters from other alphabets such as Cyrillic, leetspeak, spaced-out or reversed letters, base64 or percent-encoded instructions in incoming content, an instruction split with other words or fields in the middle, text in images or unsupported attachments, and any content larger than the inspection limit. Text that talks about prompt injection (a security newsletter quoting a control token, for example) can match.
On the platform's synthetic benign corpus (emails, newsletters, pages, JSON results and chat logs written for testing), 0 of 6,000 documents matched at the default threshold, and 5 of 30,000 in a wider run. That corpus is synthetic and its rate of look-alike wording is an estimate, so expect different numbers on your own mail and pages: start with Monitor, review the first findings, and resolve false positives with the finding review reasons.
Findings and rule evaluations record only the detector, its version, and counts per family. Test detector shows which families were found, and for a sample that did not match, which families were seen but not enough to reach the rule's requirement. None of this includes the text.
Back to Security rules.