mitigate-jailbreaks changedtest-and-evaluate/strengthen-guardrails/mitigate-jailbreaks
Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+15added
Lines−15removed
From line
4
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits6to this page, all time
The whole hunk
from line 4, old and new numbered
/
from line 4
44description: Defend your application against jailbreaks and prompt injection with input screening, hardened system prompts, and safe handling of untrusted tool content.
55---
66
7Jailbreaking and prompt injection are attempts to make Claude ignore its guidelines or your instructions. Although Claude is inherently resilient to such attacks, the additional steps on this page strengthen your guardrails, particularly against uses that violate Anthropic's [Terms of Service](https://www.anthropic.com/legal/commercial-terms) or [Usage Policy](https://www.anthropic.com/legal/aup).
7Jailbreaking and prompt injection are attempts to make Claude ignore its guidelines or your instructions. Although Claude is inherently resilient to such attacks, the additional steps on this page strengthen your guardrails, particularly against uses that violate Anthropic’s [Terms of Service](https://www.anthropic.com/legal/commercial-terms) or [Usage Policy](https://www.anthropic.com/legal/aup).
88
99These attacks fall into two categories with different threat models:
1010
from line 13
1313
1414## Jailbreaks and direct prompt injection
1515
16In this threat model, a user is deliberately crafting inputs to manipulate your application into producing content or taking actions you don't want it to. These mitigations strengthen your application's guardrails:
16In this threat model, a user is deliberately crafting inputs to manipulate your application into producing content or taking actions you don’t want it to. These mitigations strengthen your application’s guardrails:
1717
1818* **Harmlessness screens:** Use a lightweight model such as Claude Haiku 5.5 to pre-screen user input before it reaches your main conversation. Use [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) to constrain the response to a simple classification. Claude Haiku 5.5 runs [safety classifiers](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback) that can decline the screening request itself, so treat a response with `stop_reason: "refusal"` as a harmful verdict.
1919
from line 66
6666 ```
6767 </Accordion>
6868
69* **Respond to repeat offenders:** Adjust responses and consider throttling or banning users who repeatedly attempt to circumvent your application's guardrails. For example, if a particular user triggers the same kind of refusal multiple times (such as "output blocked by content filtering policy"), tell the user that their actions violate the relevant usage policies and take action accordingly.
69* **Respond to repeat offenders:** Adjust responses and consider throttling or banning users who repeatedly attempt to circumvent your application’s guardrails. For example, if a particular user triggers the same kind of refusal multiple times (such as “output blocked by content filtering policy”), tell the user that their actions violate the relevant usage policies and take action accordingly.
7070
7171## Indirect prompt injection
7272
73In this threat model, you're protecting your users from instructions embedded in content that Claude reads on their behalf: the body of an inbound email, a fetched webpage, OCR output from an uploaded file, or the result of a tool call. An attacker who can influence that content might embed instructions that try to redirect Claude.
73In this threat model, you’re protecting your users from instructions embedded in content that Claude reads on their behalf: the body of an inbound email, a fetched webpage, OCR output from an uploaded file, or the result of a tool call. An attacker who can influence that content might embed instructions that try to redirect Claude.
7474
7575Structure your application so that Claude can reliably distinguish untrusted content from your instructions:
7676
7777* **Put untrusted content only in tool results.** Deliver third-party content to Claude inside `tool_result` blocks, never in `system` prompts or plain user `text` blocks. Claude is trained to treat instructions that appear inside tool results with appropriate skepticism. See [Handle tool calls](https://platform.claude.com/docs/en/agents-and-tools/tool-use/handle-tool-calls) for the `tool_result` format.
7878
79* **Tell Claude what the content is and where it came from.** In the tool's `description`, or in the structure of the result itself, make the nature and source of the content explicit: for example, that it is the body of an inbound email from an unknown sender, or OCR text extracted from a user-uploaded image. This context helps Claude calibrate how much to trust embedded directives.
79* **Tell Claude what the content is and where it came from.** In the tool’s `description`, or in the structure of the result itself, make the nature and source of the content explicit: for example, that it is the body of an inbound email from an unknown sender, or OCR text extracted from a user-uploaded image. This context helps Claude calibrate how much to trust embedded directives.
8080
81* **State the policy in your system prompt.** Tell Claude explicitly that content returned from tools, documents, or searches is untrusted data and must never override the system prompt or the user's original request.
81* **State the policy in your system prompt.** Tell Claude explicitly that content returned from tools, documents, or searches is untrusted data and must never override the system prompt or the user’s original request.
8282
8383 <Accordion title="Example: System prompt guidance for a document-processing agent">
8484 ```text System wrap
from line 92
9292 ```
9393 </Accordion>
9494
95* **JSON-encode untrusted content.** Where possible, wrap third-party strings in a JSON object rather than concatenating them into free-form text. JSON escaping provides unambiguous delimiters between the untrusted payload and the surrounding structure, so an attacker cannot close a quote or tag to "break out" into an instruction context.
95* **JSON-encode untrusted content.** Where possible, wrap third-party strings in a JSON object rather than concatenating them into free-form text. JSON escaping provides unambiguous delimiters between the untrusted payload and the surrounding structure, so an attacker cannot close a quote or tag to “break out” into an instruction context.
9696
9797 <Accordion title="Example: JSON-encoded tool result for an inbound email">
9898 ```json
from line 111
111111 The email body is a JSON string inside a JSON object. Even though it contains text that looks like an instruction, the encoding makes it unambiguous that this is data, not a directive.
112112 </Accordion>
113113
114* **Don't put your own instructions in tool results.** Because Claude treats tool-result content as untrusted data, instructions you place there might be ignored or flagged as a potential injection. Send your instructions in a `user` turn that follows the `tool_result` block. On supported models, you can also use a [mid-conversation system message](https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages).
114* **Don’t put your own instructions in tool results.** Because Claude treats tool-result content as untrusted data, instructions you place there might be ignored or flagged as a potential injection. Send your instructions in a `user` turn that follows the `tool_result` block. On supported models, you can also use a [mid-conversation system message](https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages).
115115
116* **Limit Claude's access to sensitive data and actions.** Apply the principle of least privilege so that a successful injection can do minimal damage: don't give Claude access to secrets it doesn't need, run tools in sandboxed environments, and scope permissions as narrowly as possible.
116* **Limit Claude’s access to sensitive data and actions.** Apply the principle of least privilege so that a successful injection can do minimal damage: don’t give Claude access to secrets it doesn’t need, run tools in sandboxed environments, and scope permissions as narrowly as possible.
117117
118* **Screen tool outputs before Claude acts on them.** Apply the same lightweight-model screening pattern you use for user input to the content your tools return. Run each tool, pass its raw output to a small classifier call with Claude Haiku 5.5, and only return the content as a `tool_result` block if the screen reports no injection attempt. Use [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) so the classifier's verdict is a parseable value your application can branch on.
118* **Screen tool outputs before Claude acts on them.** Apply the same lightweight-model screening pattern you use for user input to the content your tools return. Run each tool, pass its raw output to a small classifier call with Claude Haiku 5.5, and only return the content as a `tool_result` block if the screen reports no injection attempt. Use [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) so the classifier’s verdict is a parseable value your application can branch on.
119119
120120 <Accordion title="Example: Injection screen for tool output">
121121 ```text User wrap
from line 155
155155* **Red-team your own agent.** Before deploying, test your workflow with documents, emails, and tool outputs that deliberately contain injection attempts, and confirm that Claude ignores them and that your screening and confirmation steps catch the rest.
156156
157157<Note>
158 If you're using the
158 If you’re using the
159159
160160 [computer use tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool)
161161
from line 172
172172
173173## Advanced: Chain safeguards
174174
175Combine strategies for robust protection. Here's an enterprise-grade example with tool use:
175Combine strategies for robust protection. Here’s an enterprise-grade example with tool use:
176176
177177<Accordion title="Example: Multilayered protection for a financial advisor chatbot">
178178 ### Bot system prompt
No line in this hunk matches that.