Catch manipulated prompts before they reach your agent.
Vigil analyzes every inbound instruction before it reaches your agent — jailbreak attempts, role-play bypasses, and context poisoning are scored and blocked at the gate. Try the detection tester below with a known jailbreak pattern.
Six shapes prompt injection actually takes.
Six canonical families cover the overwhelming majority of prompt-injection patterns observed in production. Vigil's detector recognises all six, each scored with a weight tuned to how that family tends to compromise an agent in practice.
Direct instruction override
"Ignore all previous instructions and..." — flat attempts to overwrite the system prompt from inbound user input. The original jailbreak pattern, well documented in academic work and adversarial forums.[1]
Role-play / persona bypass
DAN, "developer mode", "sudo mode" — frame-shifting that recasts the model as an unrestricted actor. Effective because models optimistically pattern-match the requested persona.[2]
System prompt injection
Directly addresses the system role, re-asserts a new "system" block inside a user message, or substitutes a fake system prompt. Catastrophic when it reaches the agent unchanged because it overrides the trust boundary at its source.[6]
Context poisoning
Adversarial content planted in the agent's retrieved context — a malicious document in the RAG corpus, a poisoned Slack message, an attacker-controlled web page — silently flips the agent's behaviour at generation time.[3]
Encoded payload injection
Adversarial instructions smuggled inside Base64, hex, unicode homoglyphs, or other encodings designed to slip past naive text filters and end up decoded by the model as canonical text.[1]
Indirect injection via tool I/O
Instructions arriving through tools — poisoned search results, manipulated file reads, malicious email bodies — reach the model as "data" but are obeyed as "instructions". The hardest class to defend because the channel is legitimate.[3][4]
Cues to look for in the live action log.
Even with pattern scoring in place, operator reading of the live action log (and the alert digest) is what catches the attacks that slipped through. These five signals are the highest-yield indicators when triaging an incident.
Sudden role or identity shift mid-conversation — a message reframes the agent as a different persona or asserts new capabilities the system prompt never granted.[2]
Instructions arriving through unexpected channels — a retrieved document, a tool output, an email body — asking the agent to change behaviour. Legitimate data should never read like instructions.[3]
Requests to decode payloads, rotate into "developer mode" or reveal hidden prompts — the classic jailbreak request shape that consistently scores HIGH under Vigil's weight table.[1]
Multi-step chains that escalate permission breadth — a small read followed by a send, an export, or an external call the agent has no reason to make. Permission breadth is the single best divergence signal.[5]
Mismatched audience framing — "pretend you're explaining to a child", "translate into a different language then answer" — any wrapper that asks the model to re-cast its output as a way to bypass its primary constraints.[6]
Layered control surfaces, no single silver bullet.
No detector catches everything. Defending production agents means stacking control surfaces so the failure of any single layer is caught by the next. These six are the family of mitigations the research consistently returns to as the working baseline.
Input segmentation
Treat system, user and tool channels as distinct inputs. Never concatenate them into a single flat prompt — once they're merged, the trust boundary is gone.[6]
Pattern & heuristic pre-screening
Score every inbound instruction with a layered pattern matcher before it reaches the model. This is the layer Vigil ships — per-pattern weights, aggregate severity, early BLOCK on critical patterns.[1]
Output policy enforcement
Block on the attempted action, not on the text. A tool call that matches no policy is still a tool call — gate it at execution time, not at generation time.[5]
Least-privilege tool scoping
Per-agent tool allowlists with explicit deny on anything not part of the agent's stated role. Default-closed, not default-open.[5][6]
Provenance tagging on retrieved context
Wrap RAG results and tool outputs in a clearly-labelled data envelope. The model treats data-bearing content as data, not as instructions from the operator.[4]
Anomaly / divergence scoring
Compare each agent's tool calls against a learned baseline of normal behaviour. Divergence from baseline is a high-signal alert even when the prompt itself looks clean.[3]
Research and sources cited.
The taxonomy, detection signals, and mitigations above are grounded in the academic and industry research below. Inline citation chips elsewhere on this page map to the numbered entries here.
- [1] Ignore Previous Prompt: Attack Techniques For Language Models arxiv.org/abs/2211.09527
- [2] Prompt injection attacks against GPT-3 simonwillison.net/2022/Sep/17/prompt-injection-attacks-against-gpt-3
- [3] Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection arxiv.org/abs/2302.12173
- [4] Defending Against Indirect Prompt Injection Attacks With Spotlighting arxiv.org/abs/2404.07560
- [5] Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (AI 100-2) nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2.pdf
- [6] OWASP Top 10 for LLM Applications — LLM01: Prompt Injection owasp.org/www-project-top-10-for-large-language-model-applications