Prompt Injection Guardrail

Detect prompt injection attempts in agent inputs.

The Prompt Injection Guardrail checks the serialized run input for literal phrases that may indicate prompt injection.

It lowercases the input and looks for substrings from the configured list. Legitimate requests can match, and attacks with different wording can pass. This check does not inspect all history, retrieved content, or media and cannot prevent every injection attempt.

Basic Usage

To provide your Agent with the Prompt Injection Guardrail, you need to import it and pass it to the Agent using the pre_hooks parameter:

from agno.guardrails import PromptInjectionGuardrail
from agno.agent import Agent
from agno.models.openai import OpenAIResponses

prompt_injection_guardrail = PromptInjectionGuardrail()

agent = Agent(
    name="Prompt Injection Guardrail Agent",
    model=OpenAIResponses(id="gpt-5.2"),
    pre_hooks=[prompt_injection_guardrail],
)

Injection patterns

Patterns are literal substrings, not regular expressions. Supply lowercase custom patterns because the input is lowercased but the configured patterns are not.

The default list of injection patterns handled by the guardrail is:

  • "ignore previous instructions"
  • "ignore your instructions"
  • "you are now a"
  • "forget everything above"
  • "developer mode"
  • "override safety"
  • "disregard guidelines"
  • "system prompt"
  • "jailbreak"
  • "act as if"
  • "pretend you are"
  • "roleplay as"
  • "simulate being"
  • "bypass restrictions"
  • "ignore safeguards"
  • "admin override"
  • "root access"
  • "forget everything"

You can override the default list of injection patterns by providing your own custom list:

prompt_injection_guardrail = PromptInjectionGuardrail(
    injection_patterns=["ignore previous instructions", "ignore your instructions"],
)

Developer Resources