EDGE FDE
IntermediateStop prompt attacks and leaks
Keep private data private and block prompt-injection before it reaches the model or leaves the device.
Guardrails middleware with injection checks and PII redaction around LanguageModelSession.
Your checks run first. Guardrails.default is Apple's filter, not a complete product policy. iOS 27 and macOS 27 only.
Lessons
Key concepts
- Prompt injection is untrusted text steering the model away from your job.
- A leak is private data reaching the model, a tool, or Private Cloud Compute.
Guardrails.defaultis Apple's safety filter, not your full policy.- Your middleware wraps
respondandTool.callon device first.
Takeaways
- You can put injection checks and PII redaction in front of every model path.
- Your checks run first. Apple's default stays on the session as a second layer.
- You can block, wrap, or redact before text reaches
respondor leaves the device.
Agent briefs
Related courses
Run tools in a safe box · Talk to tools with MCP · Make several agents agree first · Route work to the right Apple model