microsoft/semantic-kernel · error · AttackDetectionException

Attack detected. Operation is denied.

Error message

Attack detected. Operation is denied.

What it means

AttackDetectionFilter calls Azure AI Content Safety Prompt Shield and throws AttackDetectionException when either the user prompt or any supplied document is flagged. This is an intentional safety guard inside a Semantic Kernel prompt filter, not a system malfunction — the operation is denied to block prompt-injection / jailbreak content.

Source

Thrown at dotnet/samples/Demos/ContentSafety/Filters/AttackDetectionFilter.cs:41

        var prompt = context.RenderedPrompt;

        // Getting documents data from kernel
        var documents = context.Arguments["documents"] as List<string>;

        // Calling Prompt Shield service for attack detection
        var response = await this._promptShieldService.DetectAttackAsync(new PromptShieldRequest
        {
            UserPrompt = prompt!,
            Documents = documents
        });

        var attackDetected =
            response.UserPromptAnalysis?.AttackDetected is true ||
            response.DocumentsAnalysis?.Any(l => l.AttackDetected) is true;

        if (attackDetected)
        {
            throw new AttackDetectionException("Attack detected. Operation is denied.")
            {
                UserPromptAnalysis = response.UserPromptAnalysis,
                DocumentsAnalysis = response.DocumentsAnalysis
            };
        }
    }
}

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Review the captured UserPromptAnalysis/DocumentsAnalysis on the exception to see which input was flagged.
2. Sanitize or reject the offending document/prompt and retry with safe content.
3. If false positives recur, adjust the Prompt Shield deployment/thresholds in Azure and retest.
4. Wire a top-level handler that converts AttackDetectionException into a 400/403 response instead of crashing the process.

Example fix

// before
throw new AttackDetectionException("Attack detected. Operation is denied.")
{
    UserPromptAnalysis = response.UserPromptAnalysis,
    DocumentsAnalysis = response.DocumentsAnalysis
};

// after (caller)
try { await kernel.InvokeAsync(...); }
catch (AttackDetectionException ex)
{
    logger.LogWarning("Blocked attack. Prompt={Prompt} Docs={Docs}",
        ex.UserPromptAnalysis?.AttackDetected, ex.DocumentsAnalysis?.Count);
    return Results.Json(new { error = "Request blocked by content safety." }, statusCode: 403);
}

static bool IsBlocked(PromptShieldResponse r) =>
    r.UserPromptAnalysis?.AttackDetected is true ||
    (r.DocumentsAnalysis?.Any(l => l.AttackDetected) is true);

try { await kernel.InvokeAsync(...); }
catch (AttackDetectionException ex)
{
    logger.LogWarning("Blocked attack. Prompt={P} Docs={D}",
        ex.UserPromptAnalysis?.AttackDetected, ex.DocumentsAnalysis?.Count);
    return Results.Json(new { error = "Request blocked." }, statusCode: 403);
}

When it happens

Trigger: PromptShield's UserPromptAnalysis.AttackDetected is true, OR any entry in DocumentsAnalysis has AttackDetected true (the `.Any(l => l.AttackDetected)` path). Supplied via DetectAttackAsync with a PromptShieldRequest containing the user prompt and documents.

Common situations: End user submits adversarial input (jailbreak, hidden instructions), an ingested document contains injected instructions, or sensitivity thresholds were tuned too aggressively causing benign text to trip detection.

Related errors

• Offensive content detected. Operation is denied.
• Argument '{propertyName}' has a value that doesn't support a
• The URI scheme '{addressUri.Scheme}' is not allowed for the
• The address '{address}' is not allowed for the '{operation.N
• The operation path resolves to '{requestAuthority}', which d

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/7ee3f0c25562d66b. Report an issue: GitHub.