Prompt Injection Detection

Prompt injection detection finds instructions in inbound email that are written for an AI agent or assistant. The Autonomous Security Analyst (ASA) reviews each match, sets a verdict, and adds the Email prompt injection tag when it confirms attempted prompt injection.

Requirements

To use prompt injection detection, you need the following:

• The Enterprise plan with ASA.
• For self-hosted deployments, the latest version of Sublime.

How it works

Prompt injection detection runs in three steps:

1. Core Feed Rules flag messages that might contain prompt injection, or language aimed at influencing agentic AI. The Rules use the prompt injection model plus checks for hidden text and obfuscated instructions.
2. The Send suspicious messages to ASA Automation sends each Rule match to ASA.
3. ASA reviews the message. If ASA confirms prompt injection, it adds the Email prompt injection tag in addition to its verdict. Sublime then remediates the message in accordance with your Automation settings.

ASA runs this review only on matches from Core Feed prompt injection Rules. Custom Rules that call the function don't send messages to ASA through this Automation.

The Detection Rules intentionally cast a wide net for language aimed at AI agents and assistants. Security newsletters and research emails that quote injection text can match the Rules, and ASA screens these out automatically.

If ASA calls a Rule match Malicious for another reason, such as credential phishing, your existing ASA Automations handle it.

This feature uses the existing Send suspicious messages to ASA Automation. Set it to Active so Sublime remediates confirmed attempts, or to Passive for testing.

Review confirmed attempts

Every confirmed attempt carries the Email prompt injection tag. You find it in three places:

• The Attack Overview page shows a Prompt Injection card with the number of ASA-confirmed attempts. Select the card to open the Message List View (MLV) filtered by the tag.
• In the Message List View, filter by the Email prompt injection tag. The filter has no values to select until ASA tags a message in your organization.
• The message details page shows the tag in the message header.

Write Rules with the prompt injection function

The Message Query Language (MQL) function ml.prompt_injection_detection() checks any text you pass to it for prompt injection. That includes the current thread, the HTML body, attachment text, and previous threads. It returns two fields:

• .detection: none or injection
• .confidence: low, medium, or high

The function returns no result for organizations that aren't on the Enterprise plan.

This example flags inbound messages where any body part scores as injection:

type.inbound
and any([body.current_thread.text, body.plain.raw, body.html.raw],
        ml.prompt_injection_detection(.).detection == "injection"
)

Rules that call the beta name, beta.prompt_injection_detection(), keep working.

See ML functions for the full function reference.

Known limits

The feature, including the MQL function, depends on the Send suspicious messages to ASA Automation being Active, or Passive for testing. It is limited to organizations that use ASA. Messages that ASA doesn't review don't get the Email prompt injection tag, and the prompt injection Detection Rules don't run when the Automation is Inactive.

Non-English mail matches the Rules more often. ASA screens those matches before it adds the tag.

Sublime remediates a message in accordance with your Automation settings after ASA confirms it. If an organization is not running Inline Protection it is possible an AI agent that acts on new mail quickly enough might process the message before Sublime remediates it.

Frequently asked questions