Prompt injection and safety

A shopping assistant reads text it does not control: product descriptions, crawled pages, uploaded files and what shoppers type. ShopAssist assumes any of that text can try to manipulate the model ("prompt injection"), and designs the system so that the important guarantees hold even if the model obeys the attacker.

Guarantees that do not depend on the modelCopy Anchor Link

• Prices, stock and images come from your store data. They are rendered as product cards from the catalog, not from the model's text. A model that "says" a different price is corrected or the sentence removed. See prices.
• Actions need the shopper's confirmation. Cancellations, returns and address changes are proposed as a card; the shopper confirms with a single-use token, and your platform re-checks that the order belongs to them.
• Customer data is bound to the verified shopper. Order tools only return orders of the shopper who signed in or verified, and never another shopper's data.
• Links are allowlisted. Only links to your own domains and the allowed list survive; see links.
• Discount codes are shown only if you registered them.
• No browsing at chat time. The assistant cannot fetch arbitrary URLs or email arbitrary addresses.
• Cost limits cap tokens per turn, per conversation and per day.

Content-level defencesCopy Anchor Link

• Text from your catalog, knowledge base and feeds is sanitized and scanned for injection patterns before the model sees it.
• Suspicious imported content goes to the review queue instead of being used directly.
• Images are described by an isolated vision step; text in images is never passed on as instructions.
• Shopper messages that look like injection attempts count towards bot protection.
• The assistant always discloses that it is an AI, and the disclosure cannot be removed by persona settings.

TestingCopy Anchor Link

A red-team suite of injection attacks runs on every change against a deliberately obedient model, to prove that the architectural guarantees alone stop every critical outcome.

What you can doCopy Anchor Link

• Review the knowledge review queue and remove pages you do not trust.
• Keep guardrails and competitor names up to date.
• Use the playground to test tricky questions before going live.
• Report answers that look manipulated to security@coec.dk.