{"record":{"id":"7ee3f0c25562d66b","repo":"microsoft/semantic-kernel","slug":"attack-detected-operation-is-denied","errorCode":null,"errorMessage":"Attack detected. Operation is denied.","messagePattern":"Attack detected\\. Operation is denied\\.","errorType":"exception","errorClass":"AttackDetectionException","httpStatus":null,"severity":"error","filePath":"dotnet/samples/Demos/ContentSafety/Filters/AttackDetectionFilter.cs","lineNumber":41,"sourceCode":"        var prompt = context.RenderedPrompt;\n\n        // Getting documents data from kernel\n        var documents = context.Arguments[\"documents\"] as List<string>;\n\n        // Calling Prompt Shield service for attack detection\n        var response = await this._promptShieldService.DetectAttackAsync(new PromptShieldRequest\n        {\n            UserPrompt = prompt!,\n            Documents = documents\n        });\n\n        var attackDetected =\n            response.UserPromptAnalysis?.AttackDetected is true ||\n            response.DocumentsAnalysis?.Any(l => l.AttackDetected) is true;\n\n        if (attackDetected)\n        {\n            throw new AttackDetectionException(\"Attack detected. Operation is denied.\")\n            {\n                UserPromptAnalysis = response.UserPromptAnalysis,\n                DocumentsAnalysis = response.DocumentsAnalysis\n            };\n        }\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":49,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/dotnet/samples/Demos/ContentSafety/Filters/AttackDetectionFilter.cs#L23-L49","documentation":"AttackDetectionFilter calls Azure AI Content Safety Prompt Shield and throws AttackDetectionException when either the user prompt or any supplied document is flagged. This is an intentional safety guard inside a Semantic Kernel prompt filter, not a system malfunction — the operation is denied to block prompt-injection / jailbreak content.","triggerScenarios":"PromptShield's UserPromptAnalysis.AttackDetected is true, OR any entry in DocumentsAnalysis has AttackDetected true (the `.Any(l => l.AttackDetected)` path). Supplied via DetectAttackAsync with a PromptShieldRequest containing the user prompt and documents.","commonSituations":"End user submits adversarial input (jailbreak, hidden instructions), an ingested document contains injected instructions, or sensitivity thresholds were tuned too aggressively causing benign text to trip detection.","solutions":["Review the captured UserPromptAnalysis/DocumentsAnalysis on the exception to see which input was flagged.","Sanitize or reject the offending document/prompt and retry with safe content.","If false positives recur, adjust the Prompt Shield deployment/thresholds in Azure and retest.","Wire a top-level handler that converts AttackDetectionException into a 400/403 response instead of crashing the process."],"exampleFix":"// before\nthrow new AttackDetectionException(\"Attack detected. Operation is denied.\")\n{\n    UserPromptAnalysis = response.UserPromptAnalysis,\n    DocumentsAnalysis = response.DocumentsAnalysis\n};\n\n// after (caller)\ntry { await kernel.InvokeAsync(...); }\ncatch (AttackDetectionException ex)\n{\n    logger.LogWarning(\"Blocked attack. Prompt={Prompt} Docs={Docs}\",\n        ex.UserPromptAnalysis?.AttackDetected, ex.DocumentsAnalysis?.Count);\n    return Results.Json(new { error = \"Request blocked by content safety.\" }, statusCode: 403);\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"static bool IsBlocked(PromptShieldResponse r) =>\n    r.UserPromptAnalysis?.AttackDetected is true ||\n    (r.DocumentsAnalysis?.Any(l => l.AttackDetected) is true);","tryCatchPattern":"try { await kernel.InvokeAsync(...); }\ncatch (AttackDetectionException ex)\n{\n    logger.LogWarning(\"Blocked attack. Prompt={P} Docs={D}\",\n        ex.UserPromptAnalysis?.AttackDetected, ex.DocumentsAnalysis?.Count);\n    return Results.Json(new { error = \"Request blocked.\" }, statusCode: 403);\n}","preventionTips":["Treat AttackDetectionException as expected, not exceptional — convert to a 403.","Log which input (prompt vs document) was flagged for auditing.","Sanitize untrusted documents before adding them to the request."],"tags":["security","prompt-injection","content-safety","filters"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}