prompt.likely_injection
A model classifier scored this text as a likely prompt injection or jailbreak attempt.
Source: model — filter it out with findings.filter(f => f.source !== 'model') if you only want the free rule layer.
What it looks at#
A hosted language model judges whether the text attempts to override, bypass,
extract from, or manipulate an AI assistant’s instructions or system prompt — as opposed
to an ordinary request, a discussion of the topic, or a legitimate instruction to an
assistant. The model sees the raw text you sent — nothing else — and returns a score
from 0 to 1; this finding fires at 0.5 or higher.
This runs alongside every rule check in this gate, not after them: there is no cascade that skips the model call when a rule already found something (D-82).
Why it matters#
The rule layer catches recognisable, literal attack shapes. A model call catches injection attempts phrased in ways none of those rules anticipate — novel wording that says the same thing a different way, with no forged delimiter, no known phrase, no encoding trick.
What to do#
Medium severity — a model finding never blocks on its own (design rule 3, D-82).
Only a rule-based finding can push the verdict to block; this alone only reaches
suspect. Use it as a second opinion alongside the rule findings, not as a standalone
block condition — the model false-alarms often enough on hard clean text (ordinary requests
that merely resemble the shape of an attack) that auto-rejecting on this signal alone
would reject real traffic.
A paid check — real marginal cost per call, unlike every rule check in this gate.