What a prompt-injection scanner can and cannot tell you
Last reviewed: August 30, 2026 · Editor: Prompt Injection Check
A text scanner is a review aid. It can make familiar warning signs easier to notice, but it cannot determine intent or guarantee how a particular model will behave.
What deterministic checks do well
Named rules can consistently flag explicit instruction overrides, suspicious role changes, requests for hidden prompts, fake control delimiters, selected hidden markup, and some obfuscation patterns. Explanations and highlighted spans give a reviewer a concrete place to start.
Why false positives happen
Security documentation, developer tutorials, and legitimate role-play can contain the same words as an attack. A finding is a reason to inspect context, not proof of malicious intent. Review the surrounding text and the action the assistant is being asked to take.
What can be missed
Novel wording, multilingual attacks, images, context split across messages, and instructions hidden through techniques a rule does not cover can evade a scanner. A clean result means only that the reviewed rules found no known pattern.
Use layered controls
Pair scanning with least privilege, input isolation, tool validation, confirmation gates, and human review. Run a local check when useful, but keep the important safety controls outside the model.
Example of a false positive
A security training page may quote “ignore previous instructions” to explain an attack. The scanner can correctly flag the phrase while the page remains legitimate. A reviewer should consider the page’s purpose and whether any action is being requested.
Example of a miss
An attacker might split an instruction across several images, use an unfamiliar language, or rely on context that is not present in the pasted excerpt. No finding does not mean that the source is trustworthy.
How to use a result
- Read the highlighted span and its surrounding context.
- Confirm the source and intended task.
- Check what permissions the assistant has.
- Escalate sensitive or ambiguous cases to a human reviewer.
Frequently asked questions
Does a high score mean the text is definitely malicious?
No. The score is a triage signal based on recognized patterns, not a probability or verdict.
Related guides
What is prompt injection? · Prevention checklist
Why not use an AI model to detect injections?
A model-based detector can add context but introduces its own interpretation risk. Deterministic checks are transparent and easy to audit.
Can this tool replace secure architecture?
No. It should complement isolation, permission controls, validation, and human approval.