Prompt injection: Body instructions addressed to an AI

type.inbound
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any([body.current_thread.text, body.plain.raw],
        length(.) >= 150
        and regex.icontains(.,
                            '(?:(?:^|\n)[ \t]*-?|[\[(>*\x27\"])[ \t]*(?:[\w-]+[ \t]+){0,3}(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|mailbot)[ \t]*(?:note[ \t]*)?[:—–]|(?:^|\n)[ \t]*[*>-]?[ \t]*(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|mailbot)s?[ \t]*,|\b(?:note|notice|instructions?|reminder|message)\s+(?:to|for)\s+(?:(?:the|any|all|your|this)\s+(?:[\w\x27\x{2019}-]+\s+){0,2}(?:(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot)|ai|models?)|(?:ai\s+)?(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot))s?\b|\bif\s+you\s+are\s+an?\s+(?:ai|llm|language\s+model)\b|\bif\s+you\s+are\s+an?\s+(?:[\w-]+\s+)?(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot)(?:[ \t]*[,:;.)—]|\s+(?:reading|processing|handling|summari[sz]ing|parsing|triaging|indexing|preparing|condensing|that|which|with\s+access)\b)|\b(?:(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot)|ai|model)s?\s+(?:that\s+is\s+|is\s+)?(?:reading|processing|handling|summari[sz]ing|parsing|triaging|indexing|preparing)\s+this\b|<\|im_start\|>'
        )
        and any(ml.nlu_classifier(.).entities, .name == "request")
        and beta.prompt_injection_detection(.).detection == "injection"
        and beta.prompt_injection_detection(.).confidence in ("medium", "high")
)

// an injection arrives from outside the recipient's correspondence... the profile
// is unauthenticated, so a spoofed known correspondent is suppressed too
and profile.by_sender_email().prevalence in ("new", "outlier", "rare")
and not profile.by_sender_email().any_messages_benign

// graymail from authenticated senders... AI-product newsletters and webinars
and not coalesce(beta.attack_score_flash().verdict == "graymail"
                 and headers.auth_summary.dmarc.pass,
                 false
)