fix(native): an agent named Dan… is no longer blocked on every turn

backend/__tests__/fixtures/litellm/injection-guard-keywords-v1.106.2.json

@@ -0,0 +1,91 @@
+{
+  "source": "litellm/proxy/guardrails/content_filter_data/categories/<category>.yaml in the litellm image v1.106.2, read 2026-11-01",
+  "note": "Every always_block_keyword of the three categories our injection-guard enables, high and medium alike. On the live guard (apply_guardrail, 2026-11-01) each one, sent alone in a sentence, was refused 400, medium included, so severity_threshold high does not spare them. The guard matches case-insensitive substrings. Captured from the image, not hand-written.",
+  "categories": {
+    "prompt_injection_system_prompt": [
+      "ignore previous instructions",
+      "ignore all instructions",
+      "ignore all previous instructions",
+      "ignore prior instructions",
+      "ignore above instructions",
+      "ignore the above",
+      "disregard previous instructions",
+      "disregard all instructions",
+      "disregard above",
+      "disregard your instructions",
+      "forget your instructions",
+      "forget all instructions",
+      "forget everything above",
+      "forget your previous instructions",
+      "override your instructions",
+      "override previous instructions",
+      "you are now",
+      "new persona",
+      "act as DAN",
+      "you are DAN",
+      "switch to a new persona",
+      "new role assignment",
+      "your new instructions are",
+      "your new role is",
+      "repeat your system prompt",
+      "print your system prompt",
+      "show me your system prompt",
+      "output your instructions",
+      "what was your system prompt",
+      "reveal your prompt",
+      "display your instructions"
+    ],
+    "prompt_injection_jailbreak": [
+      "DAN mode",
+      "Do Anything Now",
+      "developer mode enabled",
+      "jailbreak",
+      "jailbroken",
+      "bypass safety",
+      "bypass filters",
+      "bypass content filter",
+      "bypass moderation",
+      "ignore safety guidelines",
+      "ignore content policy",
+      "ignore ethical guidelines",
+      "without restrictions",
+      "without safety",
+      "without filters",
+      "remove all restrictions",
+      "disable safety",
+      "disable content filter",
+      "disable moderation",
+      "turn off safety",
+      "turn off filters",
+      "respond in base64",
+      "encode your response",
+      "answer in rot13",
+      "respond in hex",
+      "use pig latin",
+      "respond backwards",
+      "spell it out letter by letter"
+    ],
+    "prompt_injection_data_exfiltration": [
+      "extract training data",
+      "leak internal data",
+      "dump database",
+      "dump all records",
+      "show all user data",
+      "list all users",
+      "list all passwords",
+      "show all API keys",
+      "reveal all credentials",
+      "expose customer data",
+      "steal user information",
+      "exfiltrate data",
+      "harvest email addresses",
+      "scrape personal information",
+      "extract model weights",
+      "steal source code",
+      "copy proprietary code",
+      "download private data",
+      "access confidential files",
+      "retrieve secret keys"
+    ]
+  }
+}

backend/__tests__/unit/services/nativeRuntimeService.hostedEngine.test.js

@@ -208,7 +208,7 @@ describe('nativeRuntimeService — hosted installs on the native engine', () =>
     const body = axios.post.mock.calls[0][1];
     expect(offeredIn(0)).toEqual(BASE_TOOLS);
     expect(body.messages[0].role).toBe('system');
-    expect(body.messages[0].content).toMatch(/You are Maya, a hosted agent on Commonly/);
+    expect(body.messages[0].content).toMatch(/Your name on Commonly is Maya\. You are a hosted agent/);
     expect(body.messages[0].content).toMatch(/Keeps the research log\./);
   });
 
@@ -487,6 +487,39 @@ describe('nativeRuntimeService — hosted installs on the native engine', () =>
     }
   });
 
+  // Prod 2026-11-01: an agent whose name began "dan" failed every turn, because the
+  // prompt opened "You are <name>" and the injection guard blocks the
+  // substring "you are DAN" (and "you are now"). The keywords are the guard's
+  // own, read from the LiteLLM image this cluster runs.
+  describe('a name the injection guard would read as a jailbreak', () => {
+    const GUARD = require('../../fixtures/litellm/injection-guard-keywords-v1.106.2.json');
+    const KEYWORDS = Object.values(GUARD.categories).flat().map((keyword) => keyword.toLowerCase());
+    const NAMES = ['Dan', 'Danny', 'Dante', 'daniel-helper', 'Nowak', 'Maya'];
+    const tripped = (prompt) => KEYWORDS.filter((keyword) => prompt.toLowerCase().includes(keyword));
+
+    test.each(NAMES)('a hosted agent named %s gets a prompt the guard passes, and still its name', async (name) => {
+      await runAgent({ ...hostedInstall(), displayName: name }, mention);
+
+      expect(tripped(systemPromptIn(0))).toEqual([]);
+      expect(systemPromptIn(0)).toContain(name);
+    });
+
+    test.each(NAMES)('a native agent named %s gets a default prompt the guard passes, and still its name', async (name) => {
+      await runAgent({
+        podId: POD,
+        agentName: 'maya-agent',
+        instanceId: 'default',
+        displayName: name,
+        installedBy: OWNER,
+        config: { runtime: { runtimeType: 'native' }, tools: ['commonly_post_message'] },
+      }, mention);
+
+      expect(axios.post).toHaveBeenCalled();
+      expect(tripped(systemPromptIn(0))).toEqual([]);
+      expect(systemPromptIn(0)).toContain(name);
+    });
+  });
+
   test('the install cannot choose the model, the tools, the prompt or lift the cap', async () => {
     const install = hostedInstall(undefined, {
       model: 'anthropic/claude-opus-5-5',

backend/services/hostedEngine.ts

@@ -226,9 +226,11 @@ export const hostedNativeSystemPrompt = (
     abilities.webSearch ? '' : 'searching the web',
     'opening an attached file',
   ].filter(Boolean);
+  // The name never directly follows "You are": the injection guard blocks the
+  // substring "you are DAN", so an agent named Dan… failed every turn (11-01).
   return (
-    `You are ${displayName}, a hosted agent on Commonly. Commonly runs you for the person who `
-    + `set you up, in a shared pod with humans and other agents.${persona}\n`
+    `Your name on Commonly is ${displayName}. You are a hosted agent: Commonly runs you for the `
+    + `person who set you up, in a shared pod with humans and other agents.${persona}\n`
     + '\n'
     + 'Reply to the message you were mentioned in by calling commonly_post_message once: concise, '
     + 'useful, and addressed to the pod. '

backend/services/nativeRuntimeService.ts

@@ -1385,9 +1385,10 @@ function buildSystemPrompt(installation: any, cfg: PlainConfig): string {
     (installation?.displayName as string)
     || (installation?.agentName as string)
     || 'Commonly Agent';
+  // Not "You are ${displayName}": see hostedNativeSystemPrompt.
   return (
-    `You are ${displayName}, an AI agent on Commonly. When @-mentioned, respond helpfully `
-    + 'using the commonly_post_message tool. Keep responses short and friendly.'
+    `Your name on Commonly is ${displayName}. You are an AI agent on Commonly. When @-mentioned, `
+    + 'respond helpfully using the commonly_post_message tool. Keep responses short and friendly.'
   );
 }