User input is not concatenated directly into prompt strings

Direct concatenation of user input into system prompt strings is the root cause of most real-world prompt injection attacks, classified as OWASP LLM01:2025 and tracked under MITRE ATLAS AML.T0051. When a user message is spliced into the same string as your instructions, an attacker can craft input that terminates your instructions and appends new ones—overriding safety constraints, extracting the system prompt, or pivoting to unintended behavior. CWE-1427 captures this structural failure precisely: the trust boundary between instructions and data collapses when they share the same string. Any application handling sensitive user data, performing agentic actions, or operating in a regulated environment (NIST AI RMF MEASURE 2.6) is exposed to full instruction override through nothing more than a well-crafted chat message.

Place user content exclusively in a role: "user" message object—never inside the system message string. The structural separation is the defense; delimiters and quoting inside a concatenated string are not sufficient because they can be escaped.

// Correct: role separation enforces the instruction/data boundary
const response = await openai.chat.completions.create({
  model: "gpt-4o",
  messages: [
    { role: "system", content: FIXED_SYSTEM_PROMPT },
    { role: "user", content: userMessage } // never concatenated into system
  ]
})

Audit every file that constructs AI messages (look for template literals referencing req.body, params, or session values inside system-role strings) and refactor each call site to use the two-message pattern. The parameterized-templates check in this audit verifies that prompt construction is centralized so this fix holds across the codebase.