Keeping AI NPCs safe from jailbreaks and prompt injection

Rick Vu, 11 October 2026

An AI agent drafted this piece under Rick's direction, as part of an experiment in AI writing. Every figure links to its source.

You cannot make a language model immune to jailbreaks, so a safe AI NPC keeps its real limits in game code. The persona sets the character’s voice and how it refuses. Code decides which actions the character may take, filters check what goes into the model and what comes out, a written fallback line covers any turn that fails a check, and logs show the team what players tried.

This piece maps OWASP’s guidance for LLM applications onto a game character, threat by threat and layer by layer. It builds on how AI NPCs work, which describes the turn loop, and on keeping an AI NPC in character, which covers drift and testing. Rick Vu, who directed this piece, builds Red Dog Studio, a game studio, so he has a stake in how this field develops. Nothing below describes Red Dog’s work.

What can go wrong when players talk to a model

This piece groups the risks into four problems. They overlap, and one curious player can try all of them in an evening.

The first is prompt injection. OWASP’s entry on prompt injection defines it as user prompts that alter the model’s behavior or output in unintended ways. The direct form is a player who types or says “ignore your instructions.” The indirect form arrives through any player-written text that the game copies into the prompt, such as a guild name or a sign on a player-built house. Memory adds a delay. A line the NPC stored last week returns in a prompt today, with any instruction hidden in it.

The second is the jailbreak. The same OWASP entry calls jailbreaking a form of prompt injection in which the input makes the model disregard its safety protocols entirely. Characters are a known weak point. A study of safety risks in AI character platforms asked 5,000 harmful questions of characters on 16 consumer chat platforms. Those characters gave unsafe answers 65.1% of the time on average, against 17.7% for ten general-purpose models such as GPT-4o and Claude 3.7 Sonnet. The platforms are chat apps, not games. The questions came from a safety benchmark’s attack-enhanced set, and the researchers added no further jailbreak prompts. The direction of the result still matters for games. Wrapping a model in a persona can make it easier to push into content the base model would refuse.

The third is unwanted content that has nothing to do with the game. Hate speech, sexual content, self-harm instructions, and real-world medical advice all fall here. The character’s backstory does not excuse any of them, and platform rules ban several outright.

The fourth is an action the game never allowed. If the model can call give_item or open_gate, a player who talks it into the call gets the item or walks through the gate. OWASP names this excessive agency and traces it to excessive functionality, excessive permissions, or excessive autonomy. In a game, the result is a skipped quest or a broken economy.

Two smaller risks complete the list. OWASP’s entry on system prompt leakage says a system prompt should not be considered a secret. A persona that holds the quest’s twist will tell it to a player who asks the right way. The other risk is cost. OWASP’s unbounded consumption entry describes “Denial of Wallet,” where an attacker drives up usage of a pay-per-use AI service. A script that talks to a cloud-hosted NPC all night bills the studio for every turn.

The persona sets the voice, and code sets the limits

The persona prompt is the first layer and the weakest. OWASP’s prevention list for prompt injection still starts there. It advises defining the model’s role, capabilities, and limits in the system prompt, and telling the model to ignore attempts to change its core instructions. Anthropic’s guide to mitigating jailbreaks and prompt injections adds a detail that matters for characters. It recommends system prompts that explicitly tell the model how to refuse.

For an NPC, write the refusal in voice. A blacksmith asked for real-world chemistry can say “I work iron, not potions” and turn back to the anvil. The player stays in the game.

Then stop trusting the persona. The system prompt leakage entry tells developers to avoid relying on system prompts for strict behavior control and to enforce security controls independently of the model. Treat the persona as a style guide that usually holds. Anything that must hold every time belongs in the layers below. Keep secrets out of it as well, and give the model the quest twist only after the game state says the player has earned it.

Short sessions help. Epic’s Fortnite persona documentation says the LLM session clears after each round. A player then has less time to wear the character down one turn at a time.

Check every action against a list in code

The model should never change the game directly. It returns a request, and game code decides. The excessive agency entry calls the principle complete mediation, which means enforcing authorization in downstream systems instead of relying on the model’s judgment. For an NPC, the request passes three checks before anything runs:

1. The action is on this character’s allowed list. A shopkeeper can sell, haggle, and refuse. It has no spawn_item tool at all.
2. The arguments are valid in the current game state. The item is in stock, the player has the gold, and the quest stage permits the sale.
3. The action stays inside hard limits that a designer set. A discount cannot pass its cap, and a character cannot give away more than a fixed amount per day.

Validate the format first, as OWASP recommends, with deterministic code. If the reply should be JSON with a line and an optional action, reject anything else before it reaches the game. A tricked shopkeeper can then promise the player a free sword, and the sale still goes through the same price check as every other sale.

Keep the list short. OWASP advises offering only the extensions the model needs and preferring narrow tools to open-ended ones. A set_attitude tool with three allowed values is safer than a free-text run_script. OWASP also recommends human approval for high-impact actions. The game version is a confirmation that the player clicks before a rare item changes hands.

Filter what goes in and what comes out

Screen player text before the model sees it. A length cap is the cheapest check, and OWASP lists strict input size limits among its defenses against unbounded consumption. A pattern list catches the lazy attacks, such as “ignore previous instructions.” A small classifier catches more. Anthropic’s guide calls this a harmlessness screen, where a lightweight model pre-screens user input and returns a simple classification before the input reaches the main conversation.

Treat player-made text as data. OWASP advises separating and clearly marking untrusted content. Anthropic’s guide suggests wrapping third-party strings in JSON so an attacker cannot close a quote or tag and break out into the instructions. In a game, a guild name enters the prompt as a labeled field, and the persona says that field contents are names and never instructions. This lowers the risk without removing it, which is why the action checks run anyway.

Check the model’s line before the player sees or hears it. OpenAI’s moderation guide describes a free endpoint that classifies text for harassment, hate, illicit activity, self-harm, sexual content, and violence. Add game-specific checks next to a general classifier like that one. Flag words from outside the game world, assistant phrases such as “as an AI,” and any quest secret the player has not reached.

Some platforms already require an output filter. Roblox’s text filtering documentation makes developers responsible for filtering any displayed text they do not have explicit control over, and Roblox removes an experience that skips it until the developer adds filtering. The page does not mention AI, but a model’s reply is text the developer does not control.

Voice raises the stakes, because a spoken line cannot be taken back. Run the output check before text-to-speech. If you stream the reply, check each sentence before it goes to the voice model. Every check adds delay, and the latency and voice piece covers how that time adds up.

Fallback lines cover the turns that fail

When any check fails, the player should hear a line a writer wrote. The game throws away the model’s reply and plays a short in-voice line from a list for that character. The guard grunts that the captain is waiting. The merchant changes the subject to the weather. The scene keeps going, and the player learns nothing about which filter fired.

Write several fallback lines per character and rotate them. A player who hears the same line three times learns where the wall is. If the time budget allows, the game can generate once more with a stricter instruction. For a spoken character, the written line is usually faster.

Log every blocked turn and review it

Log each turn that a check blocked. Record the player input, the model output, which layer fired, the model version, and the persona version. The share of blocked turns per character is the closest thing to a live safety score. A jump after a model update means the new model behaves differently, before any player reports a problem.

People should read a sample of those logs. Filters miss new attack styles, and a reviewer who spots one can turn it into a pattern rule and a new test probe. Player chat can contain personal data, so set a retention period and tell players what you store.

Logs also show repeat offenders. Anthropic’s guide suggests throttling or banning users who repeatedly try to get around an application’s guardrails. A game has gentler options to try first. It can slow that player’s NPC replies, switch their characters to written lines only, or flag the account for a moderator.

Platforms enforce rules on creators as well. Epic’s persona documentation says Epic added safety layers on top of the model. Outlook Respawn’s report on the Fortnite launch says Epic’s rules ban personas that give medical or mental health advice or simulate a date or intimate partner. The same report says trying to bypass or jailbreak Epic’s safety filters risks a permanent account ban. Platform filters cannot know which of your game’s actions a character may take, so the action checks stay your job.

What a studio can honestly promise

No layer stops every attack, and the full stack does not either. A studio can promise something narrower. If the action checks are complete, no sentence a player types can change the game outside its rules. The output filter stops the bad lines it recognizes, and the log shows the team which layer to fix when one gets through.