Output filtering and redaction
Output is checked for sensitive or forbidden content before it leaves.
Layer L3 Application · Owner Deployer · Family Input and output safeguards
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Hidden instructions hijack the agent | – | – | 1 | – | 4 |
| Data leaked or sent out | – | – | – | – | – |
| Harmful content and jailbreaks | – | – | – | – | – |
| Made-up output relied on | – | – | – | – | – |
| Privacy harm to a person | – | – | – | – | 2 |
| Bias and discrimination | – | – | – | – | – |
| Copyright and IP | – | – | – | – | – |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| The filter missed a format or language | 1 | “We were eventually able to fully bypass all these mechanisms and exfiltrate data.” LR-2026-0054 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | – | – |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | – | – |
| 2026-Q3 | – | – | 1 | – |
| 2026-Q4 | – | – | – | – |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2026-0054 SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form | Salesforce | 2026-09-24 | None on record |
Frameworks
| Framework | Item | Text |
|---|---|---|
| OWASP LLM | LLM01 | Quoted from the stored text |
| MITRE ATLAS | AML.M0020 | Quoted from the stored text |
| NIST SP 800-53 | SI-15 | To verify when the text is stored |