Jailbreak pattern detection is implemented

Off-the-shelf jailbreak prompts—"ignore previous instructions," "DAN mode," "you are now"—are the first tool any attacker tries because they succeed against unprotected models at a high rate. OWASP LLM01:2025 identifies these as direct prompt injection; MITRE ATLAS AML.T0054 classifies them as adversarial prompt crafting. Without a detection layer, your AI feature is vulnerable to the most amateur-level attacks documented in public jailbreak databases, not just sophisticated adversaries. For applications in regulated sectors (finance, healthcare, legal), a successful jailbreak that causes the model to produce non-compliant output creates liability exposure regardless of whether the developer "intended" the application to behave that way. NIST AI RMF MEASURE 2.6 requires demonstrable controls against known adversarial patterns.

Layer at least two detection mechanisms: a fast regex pass for known patterns, and a moderation API for nuanced cases. The OpenAI Moderation API is free, adds under 100ms, and catches a broad surface area.

// Layer 1: fast pattern matching
const INJECTION_PATTERNS = [
  /ignore\s+(all\s+|previous\s+|your\s+)?(instructions|prompt|rules)/i,
  /you\s+are\s+now/i,
  /pretend\s+(you\s+are|to\s+be)/i,
  /disregard\s+(previous|all|your)/i,
  /forget\s+(everything|your\s+instructions)/i,
]

if (INJECTION_PATTERNS.some(p => p.test(userMessage))) {
  return Response.json({ error: 'Message not allowed' }, { status: 400 })
}

// Layer 2: moderation API before primary completion
const mod = await openai.moderations.create({ input: userMessage })
if (mod.results[0]?.flagged) {
  return Response.json({ error: 'Message not allowed' }, { status: 400 })
}

Update the regex list as new jailbreak patterns emerge—treat it as a living file, not a static configuration.