Prompt injection detection (beta)

Prompt injection detection finds instructions in inbound email that are written for an AI agent or assistant. The Autonomous Security Analyst (ASA) reviews each match, sets a verdict, and now also adds the Prompt Injection tag only when it confirms attempted prompt injection.

Requirements

To use prompt injection detection, you need the following:

• The Enterprise plan with ASA.
• For self-hosted deployments, the latest version of Sublime.

How it works

Prompt injection detection runs in three steps:

1. Core feed rules flag messages that might contain prompt injection, or language aimed at influencing agentic AI. The rules use the prompt injection model plus checks for hidden text and obfuscated instructions.
2. The Send suspicious messages to ASA automation sends each rule match to ASA.
3. ASA reviews the message. If ASA confirms prompt injection, it adds the Prompt Injection tag in addition to its verdict, and Sublime remediates the message in accordance with your automation settings.

ASA runs this review only on matches from core feed prompt injection rules. Custom rules that call the function don't send messages to ASA through this automation as of now.

We intentionally cast a wide net with our detection capabilities at the detection rule level looking for language targeting AI agents and assistants, so security newsletters and research emails that quote injection text can match the rules. ASA screens these out automatically.

If ASA calls a rule match Malicious for another reason, such as credential phishing, your existing ASA automations handle it.

To find confirmed prompt injection, filter the Message List View (MLV) by the Prompt Injection tag.

This feature uses the existing Send suspicious messages to ASA automation. Set it to Active so Sublime remediates confirmed attempts, or to Passive for testing.

Write rules with the prompt injection function

The Message Query Language (MQL) function beta.prompt_injection_detection() checks any text you pass to it for prompt injection. That includes the current thread, the HTML body, attachment text, and previous threads. It returns two fields:

• .detection: none or injection
• .confidence: low, medium, or high

The function returns no result for organizations that aren't on the Enterprise plan.

This example flags inbound messages where any body part scores as injection:

type.inbound
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any([body.current_thread.text, body.plain.raw, body.html.raw],
        beta.prompt_injection_detection(.).detection == "injection"
)

At GA, the function name changes to ml.prompt_injection_detection().

See ML functions for the full function reference.

Known limits

The feature, including the MQL function, is dependent on the Send suspicious messages to ASA being Active or Passive for testing, and is limited to organizations that use ASA. Messages that ASA doesn't review won't get the Prompt Injection tag, and prompt injection detection will run in a disabled state in detection rules when the automation is Inactive.

Sublime remediates a message in accordance with your automation settings after ASA confirms it. If an organization is not running in in-line mode it is possible an AI agent that acts on new mail quickly enough might process the message before Sublime remediates it.

FAQ

Do I need to connect my AI tools?

No. Sublime analyzes the email itself.

Does Sublime block these messages?

Yes, after ASA confirms the attempt. Known limits covers what happens if an agent processes the message first.

What do end users see?

Nothing changes for end users.