AI gateway · Prompt and data controls
Prompt injection and data leakage: what an AI gateway can stop, and what it cannot
Prompt injection is text that changes what a language model does: typed by a user, or hidden in a document, web page or e-mail the model is asked to read. OWASP, which lists it first among risks to LLM applications, says it is unclear whether fool-proof prevention exists. An AI gateway lowers the risk by filtering prompts, removing personal data and capping usage before requests reach a model. What an injected instruction can actually do is limited by the permissions you give the application and its agents. This page shows which control sits where, what Kong AI Gateway documents for each, and why Arabic prompts need their own tests.
Published 7 min read
In short
- Two kinds of injection: direct, typed into the prompt; indirect, carried in content the model reads, such as an uploaded file or a web page.
- The gateway's part: prompt rules, a semantic guard, personal-data removal, response checks and token limits, applied to every application in one place.
- The application's part: least privilege for agents, human approval for high-risk actions, untrusted content kept separate, and output checked before other systems use it.
- Arabic needs its own test set. Deny-lists written in English do not match Arabic phrasing, and Kong's documented personal-data language models do not include Arabic.
Direct and indirect injection
Direct injection is in the prompt itself: a user writes instructions meant to override the system's rules, for example asking it to ignore its instructions and reveal them.
Indirect injection arrives through content the model processes on the user's behalf. A customer-service assistant that summarises an e-mail or an attachment can meet instructions hidden in that text, and may follow them if nothing stops it. This is the harder case: the user who triggers it may not know it is there.
Which control sits where
| OWASP LLM risk (2025) | What the AI gateway can do | What the application and its agents must do |
|---|---|---|
| LLM01 Prompt Injection | Block prompts that match deny rules or resemble known attack prompts | Keep untrusted content separate from instructions; limit what the model's output can trigger |
| LLM02 Sensitive Information Disclosure | Remove personal data from prompts before they reach the provider; check responses | Do not give the model data the user is not entitled to see |
| LLM05 Improper Output Handling | Check responses against response rules | Validate and escape model output before it reaches a browser, a database query or another system |
| LLM06 Excessive Agency | Scope agent tool calls with OAuth2, so write actions can require tighter access than read actions | Give agents only the tools and permissions the task needs; require human approval for high-risk actions |
| LLM07 System Prompt Leakage | Apply standard prompt templates across teams | Keep secrets and access rules out of system prompts altogether |
| LLM10 Unbounded Consumption | Token and cost limits per consumer | Set per-user limits inside the application where the business needs them |
None of these controls is complete on its own. The gateway column is the quickest to roll out because it covers every application at once; the application column is where an injected instruction is stopped from causing harm.
What Kong AI Gateway documents for each control
| Control | How Kong documents it | What to know before relying on it |
|---|---|---|
| AI Prompt Guard | Allow and deny lists of regular expressions, applied to user messages; a match on a deny rule, or no match on an allow rule, rejects the request | Patterns only match what you write. English deny-lists do not catch Arabic phrasing, and new wording gets past old patterns |
| AI Semantic Prompt Guard | Allows or blocks prompts by similarity to lists of example prompts, so attempts in natural language can be caught | Needs an embeddings model and a vector database. The prompt text is sent to the embeddings provider you configure, which is one more place your prompts go. Multilingual support depends on that model. Part of Kong's AI Gateway Enterprise offering |
| AI Sanitizer | Removes personal data, such as phone numbers, e-mail addresses, card numbers and national IDs, before the request reaches the model, using a separate anonymiser service; can restore the original values in the response | Kong documents bundled language models for English, Spanish, French, German, Italian, Japanese, Korean, Portuguese and Turkish, not Arabic; custom patterns are supported. Part of the Enterprise offering |
| AI Semantic Response Guard | Checks the model's response against allowed and denied examples by similarity, to catch unsafe or non-compliant content before it reaches the user | Needs an embeddings model and a vector database, like the semantic prompt guard. Decide what happens to a blocked answer and who reviews it. Part of the Enterprise offering |
| AI Prompt Template | Standard prompts and default instructions shared by every team | Templates reduce variation; they do not make instructions secret |
| AI Rate Limiting Advanced | Token and cost limits per consumer or consumer group | Part of the Enterprise offering |
| Cloud providers' own guardrails | Kong can enforce guardrails through a cloud provider's trust and safety service if you already use one | Check where that service processes the prompt |
Kong's AI Gateway is moving from plugins to an entity model in version 2, so names and configuration can change between releases. Check the documentation for the version you deploy.
Arabic prompts need their own test set
Two gaps appear as soon as prompts are in Arabic.
Wording. A deny rule for "ignore your instructions" does not match the same request written in Arabic. Semantic guards depend on how well the embeddings model handles Arabic. Build the attack set in both languages, and in the mixed Arabic-English that users actually type.
Digits. Numbers can arrive in Arabic-Indic digits (١٢٣ rather than 123), for example when typed on an Arabic keyboard layout. We tested common patterns for Saudi national IDs (\b[12]\d{9}\b) and mobile numbers (\b(?:\+?966|0)5\d{8}\b) in two regular-expression engines: neither matched ١٠٩٨٧٦٥٤٣٢ or ٠٥١٢٣٤٥٦٧٨, because the patterns start with Western digits. A national ID pattern that names both digit ranges explicitly matched both forms:
Read more
(?<![0-9\x{0660}-\x{0669}])[12\x{0661}\x{0662}][0-9\x{0660}-\x{0669}]{9}(?![0-9\x{0660}-\x{0669}])
The same approach for mobile numbers matched 05…, 9665… and +9665… in both digit forms:
(?<![0-9\x{0660}-\x{0669}])(?:\+?(?:966|\x{0669}\x{0666}\x{0666})|[0\x{0660}])[5\x{0665}][0-9\x{0660}-\x{0669}]{8}(?![0-9\x{0660}-\x{0669}])
Like the simpler ID pattern, the first one also matches any other 10-digit number starting with 1 or 2, such as a Unix timestamp in seconds, so apply it only where IDs can appear. Both patterns use PCRE syntax, which Kong documents for AI Prompt Guard. Python and JavaScript need a different escape for the Unicode ranges, and engines without look-behind, such as Go's, reject the patterns. We ran them in PCRE, Perl, Python and JavaScript, not inside Kong: run your patterns inside the gateway, and inside the AI Sanitizer's anonymiser service if you add custom patterns there, on Arabic and English samples, before production.
Test before you go live
- Build an attack set: direct and indirect injections in Arabic, English and mixed text, plus prompts carrying personal data in both digit forms.
- Add normal prompts that must pass, so you can measure false blocks as well as misses.
- Run both sets through the gateway in a non-production environment and record what was blocked, missed and wrongly blocked.
- Tune rules and re-run whenever rules, models or gateway versions change.
- In production, watch blocked requests per application, and give someone the job of reviewing them.
If your configuration offers a monitoring mode for a rule, start there; otherwise rely on the non-production runs above, and switch rules to blocking once false blocks are understood.
How Interkey helps
Interkey implements and operates Kong for organisations in Saudi Arabia, from Riyadh, in Arabic and English. For AI traffic the same order applies as for APIs: an inventory of which applications call which models with which data, a policy written with your security team, the gateway controls above configured to match it, and tests with Arabic and English attack sets before go-live. The permissions your applications and agents hold remain your teams' design decision; we help define them, and the gateway enforces the parts it can.
Questions buyers ask
Can an AI gateway prevent prompt injection?
It lowers the risk; it does not remove it. OWASP states that it is unclear whether fool-proof prevention exists. Combine gateway rules with limited agent permissions and human approval for high-risk actions.
Does the semantic guard send our prompts anywhere?
Yes. Kong documents that it sends the prompt text to the embeddings provider you configure. If prompts must stay in the Kingdom, use an embeddings model running where your policy allows.
Does personal-data removal work in Arabic?
Kong's documented bundled language models do not include Arabic. Custom patterns are supported, so Saudi formats can be added, and every pattern should be tested on Arabic samples, including Arabic-Indic digits.
Do we need Kong's enterprise licence?
For several of these controls, yes: Kong documents the semantic prompt and response guards, personal-data removal and advanced token limits as part of its AI Gateway Enterprise offering. Kong licensing is quoted on Kong's terms.
Should we block or only log at first?
Log first where you can, review what would have been blocked, then switch rules to blocking. Blocking without that review tends to stop legitimate users.
Next
Related pages
Next step
Discuss your AI controls
Tell us which applications call which models, what data the prompts carry, and whether agents can take actions in your systems. A specialist from the Riyadh team replies on Saudi working days, in Arabic or English.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia