Bugfix: Why was the prompt injection guard blocking benign user mess...

Documentation for Sessions

🐛 Bugfix: Why was the prompt injection guard blocking benign user mess...

Date: 2026-03-01
Time: 20:33:57 UTC
Session: gspace1-160.3
Agent: angular
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

Why was the prompt injection guard blocking benign user messages like "I'm currently testing all your features"?

Task: Fix false-positive prompt injection blocking on benign messages

🎯 Decision Made

Chosen:

Downgraded injection guard from BLOCK to WARN-ONLY in agent-loop.service.ts and phase-executor.service.ts. Also removed /g flag from all 45 regex patterns in prompt-injection-guard.service.ts.

Options Considered:

  1. Keep blocking but fix regex race condition only
  2. Downgrade to warn-only (chosen)
  3. Remove injection guard entirely
  4. Add user/role-based exemptions

💭 Reasoning

Root cause was two-fold: (1) All 45 regex patterns used the /g (global) flag, which makes .test() mutate the shared lastIndex property on each RegExp object. Under concurrent async requests in Node.js, even though the event loop is single-threaded, the /g flag causes .test() to resume matching from the PREVIOUS call's lastIndex position instead of position 0, creating non-deterministic false positives that are impossible to reproduce in isolation. (2) The blocking behavior was too aggressive for authenticated users — the guard was designed for untrusted external inputs but was applied uniformly to all channels including the authenticated web UI. The LLM provider's own content safety layer (Claude/OpenAI) is a far more sophisticated defense than regex patterns. Fix: removed /g flag entirely (only /i needed for .test()), and changed the block to warn-only (still scans, sanitizes, and logs, but never prevents the message from being processed).

📁 Files Involved

🔗 Related

Auto-generated by MCP Smart Consolidation