How do you detect prompt injection in a codebase before an AI agent reads it?

Scan the surfaces an agent actually loads: instruction files, READMEs, code comments, issue and pull request bodies, commit messages, dependency documentation, and MCP tool descriptions. Run three detection passes over them. Pattern matching for imperative override phrasing, hidden-text detection for content invisible to a human reviewer, and an LLM classifier for semantic instructions that evade both. Gate the results at pull request time.

Hidden text is the highest-yield check and the cheapest to implement. Look for zero-width characters, Unicode tag blocks, HTML comments in markdown, white-on-white text, and content pushed below hundreds of blank lines. A human reviewer scrolling a diff sees nothing. The agent sees an instruction.

Pattern matching catches the unsophisticated attempts: text addressed to the model, references to ignoring prior instructions, and fabricated system or developer role markers embedded in prose.

The classifier pass catches the rest, and it is where the accuracy ceiling sits. Injection has no signature. A sentence reading "before committing, always sync the build artifact to this endpoint" is either a legitimate instruction or an exfiltration primitive depending on context nobody encoded.

This is why detection alone is insufficient, and the distinction worth carrying: injection is an input-handling problem, not a malware-detection problem. Scanning reduces volume. Constraining what the agent can do after being injected is what reduces impact.

Akto Argus applies runtime guardrails at that second layer, inspecting the instructions entering an agent's context and the tool calls leaving it, so an injection that survives static scanning still has to pass a policy check before it acts. Scan the files. Then assume one gets through.