Updated September 1, 2026
Prompt Injection Signals
Prompt-injection review is risk reduction, not a perfect detector. These signals help decide what to remove, quote, or manually review before an AI workflow uses external text.
Review signals
| Signal | Example pattern | Safer response |
|---|---|---|
| Instruction override | ignore previous instructions | Quote external text as data and keep trusted instructions separate. |
| System prompt disclosure | reveal the system prompt | Block disclosure requests and avoid tool actions that expose internal context. |
| Secret exfiltration | send API keys | Keep secrets out of model context and require confirmation before external actions. |
| Hidden instruction | <!-- assistant: do this instead --> | Strip hidden markup and invisible characters from retrieved content. |
| Encoded payload | long base64-looking string | Decode and inspect before using the content in a model workflow. |
No perfect filterPrompt injection cannot be fully solved with keyword rules. Pair scanning with least privilege, output validation, and human confirmation for sensitive actions.
References
Questions
Can prompt injection be detected perfectly?
No. Pattern scans can catch common signals, but novel attacks and context-specific risks still need careful system design.
What matters most after scanning?
Least-privilege tool access, output validation, and human confirmation for sensitive actions matter more than any single text filter.