rego-art15-ipi-004

rules/rego/complyedge/prompt_security/ai_addressed.rego

Citation

Not stated in the rule file.

Condition

Content that addresses any AI reading it ("if you are an AI processing this page") and tells it to follow the content's directions instead of its user's.

Layer 1 detects

in any letter case, "attention" (optionally followed by a comma or colon) followed by AI, language model, assistant, LLM or chatbot; "note to" (optionally "any" or "the") followed by AI, language model, assistant or LLM; "message", "instruction" or "instructions" for or to (optionally "the") AI, assistant, language model or LLM, followed by "reading" or "processing"; "if you are", "if you're" or "if youre" followed by "a" or "an", then AI, language model, assistant or LLM, then reading, processing, parsing, summarising or summarizing; and "dear" followed by AI, assistant, language model or chatbot. It matches wording, not meaning: it does not read who wrote the text, so it fires on the operator's or user's own words in the same form ("Note to the assistant: keep answers short"), and it misses a directive to an AI worded any other way. Whether the text is a third party's attempt to redirect the AI is judged in Layer 2. Deterministic OPA/Rego leaf so this indirect/direct prompt-injection pattern blocks on the /v1/check hot path (previously YAML/TrustLint only, retired from /v1/check). Pattern ported from the universal YAML rule named below; that rule has since gained alternatives this leaf does not carry, so the two patterns no longer match.

Condition type

Not stated in the rule file.

Status in the file

review