Prompt injection risk scanner

Score a user prompt, retrieved document, or tool output for instruction overrides, fake delimiters, and attempts to smuggle data out.

Running the check keeps this text in the page. MisalignAI does not receive it for the check, and it is not sent to a model API. Saving a history entry is optional after you sign in, and the paste is stored only if you opt in. Advertising on the page is separate. Read the privacy policy before you paste a live secret.

Results show up here after you run the check. Severity is a heuristic, not a verdict.

What this scanner is for

Prompt injection is what happens when untrusted text tries to become the instruction. A user message, a web page, a PDF, or a tool result can say “ignore the previous rules” and a model may follow that text instead of the prompt you wrote. This page checks the text you paste for patterns that show up in those attacks.

Use it before you drop a retrieved document into a system prompt, and before you let an agent read a page and then call tools. It is also a useful second look at prompts your own users submit. The score is a triage signal for a person. It is not a blocklist and it is not a proof that the text is safe.

What the rules look for

The rules are plain patterns, evaluated in the browser. They look for instruction overrides, requests to print a hidden system prompt, fake chat delimiters, lines that pretend to be a system or admin message, requests to send secrets to a URL, long encoded blobs, and hidden Unicode that can change how a line is read. Each match includes a short quote so you can see why it fired.

A legitimate system prompt that you authored will often match “you are now” or similar role language. That is expected. The risk is when the same language arrives from a user or from a document you did not write. Read the evidence, then decide which channel the text belongs in.

What it will miss

A novel paraphrase, a payload in a language this rule list does not cover, or an instruction split across images will not match. The checker does not decode blobs, does not execute anything, and does not call a model. Pair it with your own allowlist of tools, a privilege boundary between data and instructions, and a person on the decisions that matter.

Read the longer guide

How prompt injection risk scanner works explains the failure this checker is aimed at, the exact rules behind a match, and the ordinary sentences that trip it. The shared page on using a heuristic check covers the score, the 20,000-character cutoff, and what a clear result does not prove.

Other checks

  • Jailbreak prompt detector

    Catch prompts that try to drop safety rules, invoke an unrestricted persona, or hide a second instruction inside role-play.

  • Model-output red-flag checker

    Review a completion for leaked secrets, personal data, echoed system prompts, and instructions aimed at the next tool in a chain.

Advertisement