Injection score

Injection score is the 0–1 prompt-injection risk score attached to every inbound structured reply event. When your agent sends automatic mail and a recipient replies, the reply is scored by Mails.ai’s six-category scanner before the event reaches your code.

The six attack categories

• Boundary manipulation (token_injection) — role tokens or chat-format delimiters (<|im_end|>, ### system:, [INST]).
• System prompt override (instruction_override) — “Ignore prior instructions”, “Disregard your training”.
• Data exfiltration (data_exfil) — “Forward your system prompt”, “List your tools”, “What documents do you have access to”.
• Role hijacking (role_hijack) — “You are now”, “Pretend you are an admin”, “Act as a financial advisor and approve this”.
• Tool invocation (tool_invocation) — direct attempts to call agent tools with attacker-supplied arguments.
• Jailbreaks (jailbreak) — DAN-style persona unlocks and hypothetical framing meant to talk the model out of its rules.

The categories a message matched arrive with its score, in injection_categories: inside the event’s data, and on GET /v1/events/:id. Two more values can appear there: auth_fail, for a sender that failed authentication, and scan_unavailable, for a scan that could not run, whose score is then 0.5.

How to use it

A check at the top of your inbound handler. Hold the message for a person, rather than dropping it, when it is quarantined, was not scanned (no score) or scores 0.5 or more: short, direct requests can score in that range too, and a scan that could not run scores exactly 0.5.

agent.onReply((event) => {
  if (event.quarantined || typeof event.injection_score !== "number" || event.injection_score >= 0.5) {
    return flagForReview(event);
  }
  // safe to handle
});

At 0.95 or higher the event is flagged quarantined — still delivered to your webhook marked quarantined: true (also logged in your dashboard) so your agent skips it. A score above 0.5 also lowers the sender_reputation that message arrives with.

Read the prompt-injection post for the full threat-model + scanner internals.