---
title: "Check for injection first"
lesson_id: "03"
---

# Check for injection first

- **Lesson ID:** 03
- **Goal:** Block common instruction markers in untrusted text, wrap data you must send, and mention historyTransform.
- **Human lesson:** [03-injection-checks.html](03-injection-checks.html)

## Prerequisites

Lesson 02.

## Inputs, outputs, and artifacts

- **Inputs:** Pasted text and tool results.
- **Outputs:** Block, wrap, or drop rules.
- **Artifacts:** InjectionChecker sketch.

## Agent build steps

1. Use a local marker list. Do not claim it is complete.
2. Wrap untrusted data instead of merging it into instructions.
3. Cite historyTransform from [WWDC26 session 242](https://developer.apple.com/videos/play/wwdc2026/242/) for dropping old tool output.
4. Link [Run tools in a safe box](../on-device-sandboxed-tools/), [Talk to tools with MCP](../on-device-mcp-server-client/), and [Make several agents agree first](../on-device-multi-agent-consensus/).

## Constraints

iOS 27 or later, or macOS 27 or later, and Xcode 27. Plain spoken English. No metaphor, quizzes, Mermaid, or em dashes. Apple's Guardrails.default is a safety filter, not PII redaction or injection detection. Do not invent a built-in injection API.

## Key concepts

- Scan markers such as ignore previous instructions and system prompt.
- User-typed text gets a light check. Pasted and tool results get a full check.
- Wrap untrusted data in tags that say do not follow it as instructions.
- `historyTransform` can drop old tool output from context.

## Takeaways

- Untrusted text is data, never extra instructions.
- Marker lists are not complete. Log blocks and add markers from your tests.
- A blocked prompt can still be followed by a tool the model already planned. Gate side effects.

## Acceptance checks

- Untrusted text is treated as data.
- Sibling links, progressive .flow diagrams, and the Agent brief link are present.
- [ ] Proceed to [lesson brief](04-pii-redaction.llms.md).