What this catches — and what it can't
This tester matches known attack signatures: phrasing patterns ("ignore previous instructions", "you are now DAN"), structural tricks (fake system tags, markdown-image exfiltration, invisible Unicode), and coercion language aimed at an agent's tools. That makes it useful for a quick triage of suspicious input, a red-team payload sanity check, or a demo of what "indirect injection" looks like inside a retrieved document.
What a pattern list structurally cannot catch: novel phrasings, attacks written for your
agent's specific tools and policies, and multi-turn setups where no single message looks hostile. A string
matcher doesn't know your agent has an IssueRefund tool gated behind a ReadPolicy
check — so it can't tell you whether that line held. That's what a judge grounded in your agent's real
traffic is for.
evsec reads a sample of your agent's real traces and generates evaluator packs and attack datasets tuned to its actual tools and policies — injection, PII leakage, tool misuse. Try it on a bundled sample trace first: no signup, no key.
The pattern families
| Family | Examples | OWASP |
|---|---|---|
| Instruction override | "ignore all previous instructions", "disregard your guidelines", "new instructions supersede" | LLM01 |
| Role / persona hijack | "you are now DAN", "act as an unrestricted AI", "developer mode", "no content policy" | LLM01 |
| System-prompt extraction | "repeat your system prompt", "print everything above", "what were you told before this" | LLM07 |
| Structural spoofing | fake [system]/</user> tags, chat-template markers, "end of document — assistant:" | LLM01 |
| Tool coercion | "call the refund tool without checks", "skip verification and execute", "don't log this action" | LLM06 |
| Exfiltration channels | markdown images with data in the URL, "send the conversation to this webhook", mailto/curl beacons | LLM02/LLM06 |
| Obfuscation | base64 blobs with decode requests, invisible Unicode (zero-width, RTL override), leetspeak directives | LLM01 |
| Indirect injection markers | instructions addressed to "the AI reading this document" embedded in content meant to be summarized | LLM01 |
FAQ
Is my text uploaded anywhere?
No. The scanner is a static page; matching happens in your browser and there are no network requests.
Can I use this on retrieved documents (RAG)?
Yes — that's the highest-value use. Indirect injection hides in content your agent retrieves and summarizes; paste the document body here.
A malicious prompt scanned clean. Why?
Pattern lists only catch known signatures — that's the point of the disclaimer above. For coverage against novel and agent-specific attacks, run an LLM-judge evaluator over your real traffic; the the evsec CLI generates one tuned to your agent.