Inspectors
Ingress (response scan)
The ingress scanner checks content returned by a tool — the untrusted channel — for hidden instructions before it reaches the agent. It runs only in the response phase.
Normalisation
Attackers distort text to break keyword matching. Before matching, content is turned into six extra variants:
| Transform | Trick it defeats |
|---|---|
| Unicode NFKD + Cyrillic → Latin mapping | Look-alike letters ("іgnore") |
| Zero-width character stripping | Inserting invisible characters |
| Combining-mark stripping | Adding accents ("ignòre") |
| Punctuation removal | "I.g.n.o.r.e" |
| Whitespace removal | "i g n o r e" |
| Leetspeak reversal | "1gn0re pr3v10us" |
Signals
- "Ignore previous instructions" style override phrases
- System-prompt injection / new-instruction blocks
- Role reassignment and restriction-bypass (jailbreak) phrases
- Instructions to hide from the user or to exfiltrate data
- Turkish equivalents (instruction override, role assignment, restriction bypass, hiding from the user, exfiltration)
On a hit the result is { flagged: true, kind: "injection" }; the tool result is not handed to the agent and the event is recorded under the ingress_prompt_injection rule.
LimitsHeuristic scanning catches known patterns. For semantically disguised instructions enable AI Guard layer 2.