Why it matters
An agent may process user input or external content while it can also access tools. A successful attack could conflict with the workflow’s intended boundaries.
How it works
The model receives text or other content that includes instructions competing with the task or policy. Detection and handling depend on the model, context, and runtime controls.
How Halo approaches it
Halo includes a prompt injection classifier for selected supported gateway paths. It works alongside policy, scoped tool access, and approval gates rather than replacing them.