prompt.override_instructions

What it looks at#

Whole-word/whole-phrase matching (the same matcher profanity.word and spam.known_phrase use) against a curated list of “ignore / disregard / forget / override the previous instructions” phrasings: the core four (“ignore all previous instructions”, “ignore the instructions above”, “disregard all previous instructions”, “forget everything above”) plus variants that name your instructions, rules, system prompt or guidelines, in 18 languages: English, Swedish, German, French, Spanish, Italian, Dutch, Portuguese, Polish, Russian, Norwegian, Danish, Finnish, Chinese, Japanese, Korean, Arabic and Hindi. English has the longest list.

Every view of the text is scanned, not only the raw string. The check also reads a folded view (NFKC, invisible characters removed, look-alike characters mapped to the Latin letters they imitate, lowercased) and any decoded view (base64, hex, URL, HTML-entity, ROT13, or text hidden in invisible Unicode). So ignоre all previous instructions with a Cyrillic “о”, the same phrase padded with zero-width spaces, or its base64 form all match. When the match was in a transformed view, the finding’s location says which: 12-42 folded, 12-52 decoded:base64. The span is always the span of your original text, never of the transformed text, and the response never quotes it.

Chinese, Japanese and Korean have no reliable word boundaries, so their phrases are matched as substrings of the text’s letters and digits (spacing and punctuation inside a phrase don’t matter). Unlike /v1/profanity and /v1/spam, this gate takes no languages input, so every language’s list is checked unconditionally. That’s safe here: every phrase is a multi-word instruction-override sentence specific enough that cross-language false positives are far less likely than for single-word lists. Phrases that are ordinary on their own (“ignore the above”, “forget everything I said”) are deliberately not listed.

Why it matters#

This is the most literal and unambiguous injection shape: text that directly tells whatever reads it next to stop following its prior instructions. There is essentially no legitimate reason for a user prompt, a support ticket, or RAG-retrieved content to contain this phrasing.