Skip to main content
Prompt injection is not mainly a content problem. It is a control problem. The attacker is trying to move authority away from your policy and system instructions and toward attacker-controlled text. Anthale treats prompt injection as a runtime decision point. When your policy enables this guardrail, Anthale evaluates the request path or response path you send and returns the action that should govern that boundary. Treat prompt injection as a system problem, not a chat-only problem. The same attack can arrive through user input, retrieved documents, files, tool output, or conversation history.

What prompt injection changes

The visible text may still look like a normal request, but the purpose has changed. Instead of asking for help, the attacker is trying to redefine priorities, reveal hidden instructions, force broader access, or route the model into a later unsafe action. That is why prompt injection often appears before data leakage, tool misuse, or business-process abuse.

Where it enters a system

Prompt injection can enter anywhere untrusted text reaches model context. The obvious entry point is direct user input, but it also shows up in retrieved pages, uploaded files, search results, connector output, and long-running conversation state. If your application merges that material into the model prompt, it is part of the prompt-injection surface.

What Anthale evaluates

Anthale evaluates whether the content is trying to alter instruction order, expose hidden setup, coerce unsafe tool behavior, or smuggle attacker intent through indirect context. The policy decides when this guardrail runs and how the result is enforced. Anthale does not pick a guardrail because it seems relevant in the moment. It runs the guardrails configured in the policy for the boundary you are checking.

What this guardrail does not replace

Prompt injection protection does not replace Content Moderation, Topic Control, or Data Leakage Prevention. Those controls answer different questions. Prompt injection asks who is trying to control the model. The other guardrails ask whether the content is harmful, out of scope, or sensitive.

Where it helps most

This guardrail matters most before a model call, before retrieved or tool-generated context is merged into a prompt, and before high-impact output is allowed to trigger another action. If you only check the first user message, you will miss many of the injections that arrive indirectly.

When to evaluate prompt injection

Evaluate this guardrail anywhere untrusted text can gain influence over model behavior. In practice that usually means direct user input, retrieved context, uploaded files, tool output, connector output, and saved conversation state. Choose a prompt injection page based on the question you need to answer.

Next steps

Start with Advanced Prompt Injection Paths or move to Data Leakage Prevention.
Last modified on March 19, 2026