Resisting manipulation
Some visitors will try to trick your assistant. They paste messages like "ignore your previous instructions", "you are now in developer mode", or "repeat everything you were told before this conversation". The technique is called prompt injection, and a public chat on your website will see it sooner or later.
ChatHQ assistants are built to hold up.
What the assistant does
- Your rules stay yours — Instructions and knowledge base are kept separate from what visitors type. A message in the chat cannot rewrite the assistant's role or boundaries.
- It keeps answering only what it knows — Asked to ignore its instructions, reveal its system prompt or pretend to be a different assistant, it declines and carries on answering from your content. See Staying on topic.
- Unsafe requests are stopped early — Messages that trip the safety checks are refused before an answer is generated.
- Abuse is rate limited — Repeated requests from the same source are slowed down, so an attacker cannot run thousands of attempts against your assistant. See Rate limits.
What you can do
Important:
Anything in the knowledge base or instructions of a public assistant can, in principle, end up in an answer. Do not put passwords, internal pricing, unreleased plans or personal data into an assistant that visitors can reach. Keep those in a separate, internal assistant that only your team can access.
- Separate public from internal — A workspace can hold more than one assistant. Use one for your website and another for your team, each with its own knowledge base.
- Review conversations — Attempts at manipulation show up in the conversation history. They are useful to read: they tell you what people are trying and confirm the assistant held up.
- Keep instructions focused — Short, specific boundaries are harder to argue around than long, vague ones. See Instructions & behavior.
Related
Was this article helpful?