Detect Prompt Injection Attacks on AI Systems

Ankit Mehta@Secvyn

•updated Jun 30, 2026•6•0•16

This rule detects potential prompt injection attempts targeting AI systems by looking for specific keywords related to AI models (gpt, claude, copilot) in HTTP logs, combined with suspicious characters or commands commonly used in injection attacks (e.g., <script>, javascript:, eval(). The rule triggers if 5 or more such attempts are observed from a single IP within an hour.