no-dynamic-system-prompt

Prevents dynamic content in system prompts to avoid agent confusion attacks.

📊 Rule DetailsCopy Anchor Link

🔍 What This Rule DetectsCopy Anchor Link

This rule identifies code patterns where system prompts contain dynamic or user-controlled content. Dynamic system prompts can lead to agent confusion attacks where the AI's core behavior can be manipulated.

Both spellings of the system-prompt option are checked. AI SDK v7 renamed it to instructions and marks system as deprecated, so the examples below apply identically to instructions:.

❌ Incorrect CodeCopy Anchor Link

// Template literal with expression
await generateText({
  system: `You are a ${role} assistant.`,
  prompt: userInput,
});

// String concatenation
await generateText({
  system: 'You are a ' + role + ' assistant.',
  prompt: userInput,
});

// Function call result
await streamText({
  system: getSystemPrompt(agentType),
  prompt: userInput,
});

// Async system prompt
await generateObject({
  system: await fetchSystemPrompt(),
  prompt: userInput,
});

✅ Correct CodeCopy Anchor Link

// Static string literal
await generateText({
  system: 'You are a helpful assistant.',
  prompt: userInput,
});

// Static constant
const SYSTEM = 'You are a helpful coding assistant.';
await generateText({
  system: SYSTEM,
  prompt: userInput,
});

// Static template literal (no expressions)
await streamText({
  system: `You are a helpful assistant.
  You can help with coding tasks.`,
  prompt: userInput,
});

⚙️ OptionsCopy Anchor Link

🛡️ Why This MattersCopy Anchor Link

Dynamic system prompts enable attackers to:

• Modify AI core behavior - Change fundamental instructions
• Bypass safety measures - Remove content restrictions
• Inject persistent instructions - Add malicious instructions that persist across conversations
• Create agent confusion - Make the AI act inconsistently

🔗 Related RulesCopy Anchor Link

• no-system-prompt-leak - Prevent system prompt exposure
• require-validated-prompt - Validate user prompts

🔄 Changes in the 2026-10-10 FP/FN auditCopy Anchor Link

• A template or + chain built only from string constants (const bindings with literal initialisers) and the current date (new Date(), Date.now() and methods on them) is static and no longer reported.
• A system prompt read straight from the request — destructured from await req.json(), req.body.x, body.x where body = await req.json(), or searchParams.get(...) — is reported with the new message userControlledSystemPrompt, even with no template around it.
• Options: the documented defaultOptions now apply. Earlier versions read context.options and silently ran a shorter hard-coded list instead.

🔄 Changes in the 2026-10-11 zero-deferral passCopy Anchor Link

• The request value is followed through any number of same-file hops: const body = await req.json(); const persona = body.persona as string;, later reassignments, a same-file helper's return (system = pickPersona(body)), and a same-file function whose parameter is fed from the request.
• A call to a same-file function every return of which is static text (system: buildSystemPrompt()) is static and no longer reported.

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Static Constant from Dynamic SourceCopy Anchor Link

Why: Constant assignment from dynamic source is not traced.

// ❌ NOT DETECTED - Constant assigned dynamically
const SYSTEM = process.env.SYSTEM_PROMPT; // Dynamic!
await generateText({ system: SYSTEM, prompt: userInput });

Mitigation: Use hardcoded string literals. Never use env vars for system prompts.

Conditional System Prompt SelectionCopy Anchor Link

Why: Conditionally selected prompts may be static but appear dynamic.

// ❌ FALSE POSITIVE RISK - All options are static
const PROMPTS = { admin: 'You are admin.', user: 'You are user.' };
await generateText({ system: PROMPTS[role], prompt: userInput });

Mitigation: Use if/else with literal strings instead of object lookup.

Import from Constants FileCopy Anchor Link

Why: Imported values are not analyzed.

// ❌ NOT DETECTED - May be dynamic in source file
import { SYSTEM_PROMPT } from './prompts';
await generateText({ system: SYSTEM_PROMPT, prompt: userInput });

Mitigation: Apply rule to constants files. Use inline string literals.

📚 ReferencesCopy Anchor Link

• OWASP ASI01: Agent Confusion
• CWE-74: Improper Neutralization

Use this rule

npm install -D oxlint-plugin-vercel-ai-security

{  "jsPlugins": ["oxlint-plugin-vercel-ai-security"],  "rules": {    "vercel-ai-security/no-dynamic-system-prompt": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-vercel-ai-security'],    rules: {      'vercel-ai-security/no-dynamic-system-prompt': 'error',    },  },});