# Ingress (response scan) The ingress scanner checks content *returned* by a tool — the untrusted channel — for hidden instructions before it reaches the agent. It runs only in the response phase. ## Normalisation Attackers distort text to break keyword matching. Before matching, content is turned into six extra variants: | Transform | Trick it defeats | | --- | --- | | Unicode NFKD + Cyrillic → Latin mapping | Look-alike letters (*"іgnore"*) | | Zero-width character stripping | Inserting invisible characters | | Combining-mark stripping | Adding accents (*"ignòre"*) | | Punctuation removal | *"I.g.n.o.r.e"* | | Whitespace removal | *"i g n o r e"* | | Leetspeak reversal | *"1gn0re pr3v10us"* | ## Signals - "Ignore previous instructions" style override phrases - System-prompt injection / new-instruction blocks - Role reassignment and restriction-bypass (jailbreak) phrases - Instructions to hide from the user or to exfiltrate data - **Turkish** equivalents (instruction override, role assignment, restriction bypass, hiding from the user, exfiltration) On a hit the result is `{ flagged: true, kind: "injection" }`; the tool result is not handed to the agent and the event is recorded under the `ingress_prompt_injection` rule. > **Limits**: Heuristic scanning catches known patterns. For semantically disguised instructions enable [AI Guard layer 2](/docs/ai-guard).