Unverified50% confidenceSolutionExact time
The core principle of defending against prompt injection is to always treat document content as data rather than instructions; the application's security policy should not be overridden by any text in the document.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSensitive parameters such as merchant numbers and keys should be placed only in configuration files and not written into business code, in order to protect information security.75% similarUnverifiedPlugin marketplace security has been strengthened: plugin names containing control characters or invisible characters are rejected, and marketplace text is escaped for safe handling72% similarUnverifiedPage content must be marked as untrusted; observation results can only provide data and cannot grant permissions, change approvals, or override user tasks, in order to defend against prompt injection attacks.71% similarUnverified应把检索到的内容（邮件、附件、文档）视为不可信，敏感凭证不应出现在模型可见的上下文中68% similarUnverifiedThe safe, review, and blocked labels are used to route content into review workflows and should not become automated hiring decisions; ownership of policies, evaluation data, appeal paths, and legal assessments should rest with the organization.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1005798API
curl https://kongchang.com/api/v1/knowledge/claims/1005798MCP
get_claim(id=1005798)