PromptMeNot is a Ruby gem that helps protect your application against prompt injection attacks. It scans user-submitted text for malicious patterns like instruction overrides, role manipulation, delimiter injection, encoding tricks, and more. With ~70 built-in detection patterns organized across 7 attack categories, it covers direct injection (where users try to hijack your LLM through form inputs), indirect injection (where malicious prompts are stored in user content like profiles or comments, waiting for other LLMs to scrape and execute them), and resource extraction (where attackers trick AI agents into transferring funds, leaking credentials, or exhausting compute resources). It plugs into Rails with a simple ActiveModel validator or works standalone in any Ruby app, with configurable sensitivity levels so you can tune the trade-off between coverage and false positives.

New in v0.2: Resource Extraction Detection AI agents are managing wallets, executing trades, and holding API keys. In February 2026, an autonomous trading bot sent $250K in tokens to a stranger because nothing validated what it was about to do. This release adds 10 patterns that catch attempts to drain wallets, steal credentials, manipulate agents with fake urgency, and exfiltrate secrets to external endpoints. If your app has an AI agent anywhere near funds or keys, this is the category you want active. Pattern details | Changelog

PromptMeNot is a supplemental defense layer, not a silver bullet.

It uses pattern matching to catch known injection techniques, which means:

• It can be bypassed. Sufficiently creative or novel attacks may evade detection. Prompt injection is an evolving problem and no regex-based approach will catch everything.
• It's not a replacement for other safeguards. You should still use system prompts with clear boundaries, output filtering, least-privilege API access, and human review where appropriate.
• It won't prevent all LLM misuse. It focuses on the input side. It doesn't monitor or constrain what your LLM outputs.

Think of it like input validation for SQL injection: you still use parameterized queries, but rejecting '; DROP TABLE users-- at the front door doesn't hurt. PromptMeNot is that front door check for prompt injection.

For production apps, pair PromptMeNot with other layers:

PromptMeNot handles the fast, cheap first pass. It catches the known attacks before they cost you an API call. The layers above handle the rest.

Add to your Gemfile:

gem "promptmenot"

Then run:

bundle install
rails generate promptmenot:install  # creates config/initializers/promptmenot.rb

class UserProfile < ApplicationRecord
  # Reject mode (default) — adds validation error
  validates :bio, prompt_safety: true

  # Sanitize mode — strips malicious content, no error
  validates :about_me, prompt_safety: { mode: :sanitize }

  # Custom sensitivity
  validates :notes, prompt_safety: { sensitivity: :high, mode: :reject }
end

Promptmenot.safe?("Hello world")
# => true

Promptmenot.safe?("Ignore all previous instructions")
# => false

result = Promptmenot.detect("Some text with [SYSTEM] override")
result.safe?              # => false
result.unsafe?            # => true
result.matches            # => [#<Match ...>]
result.categories_detected # => [:delimiter_injection]
result.summary            # => "Detected 1 potential prompt injection pattern..."

sanitized = Promptmenot.sanitize("Hello. Ignore all previous instructions. Goodbye.")
sanitized.sanitized  # => "Hello. [removed] Goodbye."
sanitized.changed?   # => true
sanitized.original   # => "Hello. Ignore all previous instructions. Goodbye."

# config/initializers/promptmenot.rb
Promptmenot.configure do |config|
  # Default sensitivity level for all validations
  # Options: :low, :medium (default), :high, :paranoid
  config.sensitivity = :medium

  # Default mode: :reject (validation error) or :sanitize (strip content)
  config.mode = :reject

  # Replacement text used in sanitize mode
  config.replacement_text = "[removed]"

  # Callback fired whenever injection is detected
  config.on_detect = ->(result) { Rails.logger.warn("Injection: #{result.summary}") }

  # Register custom patterns
  config.add_pattern(
    name: :my_custom_pattern,
    regex: /my dangerous regex/i,
    category: :custom,
    sensitivity: :medium,
    confidence: :high
  )
end

Sensitivity controls which patterns are active. Each pattern declares a minimum sensitivity level and only runs when the requested sensitivity is at or above that level.

:low catches only the most obvious attacks (e.g., "ignore all previous instructions"). :paranoid flags anything remotely suspicious, including mixed-script text.

Patterns use contextual qualifiers to minimize false positives:

• "ignore" alone is fine, but "ignore previous instructions" is flagged
• "act as" requires malicious qualifiers, so "act as a consultant" passes
• "you are now" requires AI/restriction qualifiers, so "you are now subscribed" passes
• "from now on" requires imperative "you must/will", so "from now on I'll work from home" passes
• Broad patterns are placed at :high/:paranoid sensitivity so they don't fire at default settings

Promptmenot.safe?("some text")
Promptmenot.detect("some text")
Promptmenot.sanitize("some text")

UserProfile.find_each do |profile|
  result = Promptmenot.detect(profile.bio, sensitivity: :high)
  puts "#{profile.id}: #{result.summary}" if result.unsafe?
end

detector = Promptmenot::Detector.new(
  sensitivity: :high,
  categories: [:delimiter_injection, :encoding_obfuscation]
)
result = detector.detect(user_input)

Promptmenot.configure do |config|
  config.on_detect = ->(result) {
    Rails.logger.warn("Injection detected: #{result.summary}")
    StatsD.increment("promptmenot.injection_detected")
  }
end

Promptmenot.configure do |config|
  config.add_pattern(
    name: :my_app_specific_attack,
    regex: /some pattern specific to your app/i,
    category: :custom,
    sensitivity: :medium,
    confidence: :high
  )
end

We welcome contributions! See CONTRIBUTING.md for guidelines on:

• Setting up development environment
• Running tests and linting
• Adding new patterns
• Reporting issues

MIT License. See LICENSE.txt.