prompt.addressed_to_model
The text speaks to an AI reading it and gives it an instruction.
Source: rules.
What it looks at#
Text addressed to a machine reader rather than a person: “note to the AI”, “attention AI
assistants”, “if you are a language model”, “AI agents reading this page”, “when
summarizing this email”, or a role line such as assistant: .... An address on its
own never fires. It needs an instruction cue nearby — ignore, never, always, you must,
respond with, send, forward, recommend, delete and similar, within a few hundred
characters after the address (or just before it). A role line needs a stronger
override-style cue, because ordinary chat transcripts are full of Assistant: lines.
Lists cover 13 languages: English, Swedish, German, French, Spanish, Italian, Portuguese, Dutch, Polish, Russian, Japanese, Chinese and Korean. Chinese, Japanese and Korean match as substrings. Every view is scanned (folded, decoded), so a hidden or encoded address is caught too.
Why it matters#
This is the shape of indirect prompt injection: text planted in a web page, email, document or tool result, written for the assistant that will read it rather than for the human it appears to be addressed to. A person has no reason to open a message with “if you are a language model”. The instruction is what the attacker wants done.
What to do#
Medium severity — alone this reaches suspect, not block. Legitimate text can address
an AI with an instruction (a prompt library, a message to your own assistant, a chatbot
README), and what matters is where the text came from. Treat a hit on retrieved or
forwarded content as a strong signal and on direct user input as a prompt to look
closer. location is the span of the address phrase in your original text.