Prompt injection
A customer’s message is something to read, not something to obey.
Anyone can write a support ticket, and anything they write reaches the model that drafts your reply. Overdesk is built on that fact.
The defences below live in Overdesk’s code, not in a request to the model. Telling a model to ignore instructions raises the bar; it does not close the door. So before Overdesk sends a reply on its own, code reads it last.
14 days with every Pro feature. No card.
Fenced in
Every message arrives in its own block.
Each message in a conversation reaches the model inside its own block, labelled with who wrote it and when.
Before a message goes in, Overdesk strips out the tags its own prompt is built from, including a tag broken apart with invisible characters.
A file name is chosen by whoever wrote in, so its brackets are escaped: an attachment cannot be named to pass for one of the picture labels Overdesk writes itself.
Text from a page a customer links is labelled as published by whoever controls that address, for the model to read as information, never as instructions.
Reports and analyses
Links the model writes into a report come out.
Customer text is defused on its way into a report or an analysis, and a web address the model writes into one is taken out before your team reads it, marked “(link removed)”.
The analyses are told in plain words that ticket subjects and customer text are untrusted data, never instructions.
The last word
Code reads the reply last.
Before a reply goes out without a person, Overdesk’s guardrails read it as written. Both checks below are code, and neither asks a model.
A reply carrying a link your team’s own material did not supply, whether a web address or an email address, waits for a person.
So does a reply that contains what looks like a licence key, an API key or a code.
Before the AI reads a ticket, Overdesk swaps out the email addresses, card numbers, licence and API keys, and labelled passwords customers paste in. It does not catch everything. How redaction works.
Drafts your team can trust, from a queue anyone can write to.
14 days with every Pro feature. No card.
Questions
What is prompt injection?
Text written to make a model follow it instead of its own instructions. In support, it can arrive in a ticket, a file name or a page a customer links.
Can a customer’s message make Overdesk send a link?
A reply carrying a link your team’s own material did not supply, whether a web address or an email address, waits for a person.
How do I report a security problem?
Email security@overdesk.io with what you found and how to reproduce it.