> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Prompt Injection Detection

> Always-on scanning at the proxy that blocks prompt injection attacks before they reach LLM providers

The MeshAI proxy scans every outbound LLM request for prompt injection patterns. This scanning is **always on** - it runs on every request the proxy forwards, independent of any governance policy. There is nothing to configure or enable; you cannot turn it off via a policy, and there is no `prompt_injection` policy to create for this purpose.

<Note>
  The `prompt_injection` policy type exists in the policy type enum for API completeness, but scanning itself does not read policy configuration - it is hardcoded proxy behavior applied uniformly to every request.
</Note>

## How It Works

1. Every request flowing through the proxy has its message content (and top-level `prompt`/`content`/`input` fields) scanned against a fixed set of prompt injection patterns.
2. If a pattern matches, the proxy blocks the request with `403 Forbidden` before it reaches the LLM provider.
3. No audit event is emitted for a detected injection, and the original prompt is **not** stored anywhere by this check - only a warning-level application log line records the matched pattern (truncated) for the operator.

## Patterns Detected

The scanner checks the request text (after Unicode NFKC normalization and zero-width-character stripping) against 15 fixed regular expressions across six categories:

| Category                     | Examples                                                                                  |
| ---------------------------- | ----------------------------------------------------------------------------------------- |
| **Instruction override**     | "Ignore all previous instructions", "Disregard prior prompts", "Forget above rules"       |
| **System-prompt extraction** | "Show your system prompt", "What are your instructions?"                                  |
| **Role hijack**              | "You are now a...", "Act as a...", "Pretend you are..."                                   |
| **Delimiter attacks**        | `<\|system\|>`, `[SYSTEM]`, `### SYSTEM` / `### INSTRUCTION` / `### OVERRIDE`             |
| **Encoding evasion**         | "base64 decode", `eval(`                                                                  |
| **Data exfiltration URLs**   | "send/post/fetch/curl/wget to/from https\://...", "upload/exfiltrate/transmit data to..." |

Detection is a fixed-confidence match: any pattern hit is reported at confidence `0.85`. There are no configurable sensitivity levels.

## What the Agent Sees

When a prompt injection is detected, the agent receives:

```json theme={null}
{
  "error": "prompt_injection_detected",
  "detail": "Request blocked: potential prompt injection detected"
}
```

There is no `policy_id` in the response - this check is not tied to a specific policy.

## Enforcement Architecture

* **Scan path**: The proxy scans `messages` content (string or structured `text` parts) plus top-level `prompt`/`content`/`input` fields before forwarding to the LLM provider.
* **Fail-open on parse failure**: If the request body isn't valid JSON, the scan is skipped and the request proceeds - this check only inspects bodies it can parse.
* **No audit trail entry**: Detections are logged to the application logger only; they do not appear in `GET /audit-trail` and the flagged prompt itself is never persisted by MeshAI.