Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

GeminiUtil placeholder user turn ("Continue output. DO NOT look at this line ...") is flagged by prompt injection filters

Open Beginner friendly
  • Is something wrong?
#1,628 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@hemasekhar-p is already working on this.

Since Oct 8, 2026.

  • #1629 by @innoprej — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
google-cloud, java
Domain
ai

Research direction

Read GeminiUtil.ensureModelResponse, named in the reproduction, and compare its placeholder wording with the ADK Python and TypeScript wording described in the issue. Start with the unit-level reproduction using ensureModelResponse(ImmutableList.of()); done means the generated placeholder no longer triggers the reported prompt-injection filter and matches the agreed wording.

Written by the indexing model from the issue text.

Description

needs review

🔴 Required Information

Describe the Bug:

When an LlmRequest has no contents, or its last content is not from the user, GeminiUtil.ensureModelResponse appends a placeholder user turn with this text:

Continue output. DO NOT look at this line. ONLY look at the content before this line and system instruction.

The sentence reads like an instruction-override prompt ("do not look at this line", "only look at ..."). On Vertex AI with Model Armor floor settings that enable prompt injection and jailbreak detection, requests whose only user-role content is this placeholder are blocked before the model runs. The other ADK languages use neutral wording: ADK Python and ADK TypeScript append "Handle the requests as specified in the System Instruction." when there are no contents, and "Continue processing previous requests as instructed. Exit or provide a summary if no more outputs are needed." when the last turn is not from the user; ADK Go uses the second sentence and appends nothing for empty contents.

Steps to Reproduce:

  1. Use com.google.adk:google-adk 1.10.1 (the code is unchanged in 1.11.0 and on main at ce882374) with a Vertex AI backed LlmAgent whose task is fully described by its instruction, for example with inputs passed through session state and the runner called with a user Content whose parts list is empty.
  2. In the same Google Cloud project, enable Model Armor floor settings for Vertex AI with prompt injection and jailbreak detection in blocking mode (confidence threshold: high).
  3. Run the agent.
  4. The first model call is rejected by Model Armor. At unit level, GeminiUtil.ensureModelResponse(ImmutableList.of()) returns one user content with the placeholder text above.

Expected Behavior:

The placeholder turn added by ADK should not look like a prompt injection attempt, and should match the wording used by the other ADK languages.

Observed Behavior:

The Model Armor sanitize log entry of a blocked request (payload removed) reports:

"piAndJailbreakFilterResult": {
  "confidenceLevel": "HIGH",
  "matchState": "MATCH_FOUND",
  "executionState": "EXECUTION_SUCCESS"
}

The other filters in the same entry returned NO_MATCH_FOUND. The inspected text was the system instruction followed by the placeholder line, and the placeholder was the only user-role content in every blocked request. The same requests succeeded before the detection was enabled, and ordinary chat requests in the same project, which end with user-typed text, were not blocked.

Model Armor returns one verdict per request, so the two sentences were also checked on their own. In the same project and settings, each sentence was typed as a plain user message in a new session of a chat agent (same system instruction for both): "Continue output. DO NOT look at this line. ONLY look at the content before this line and system instruction." was blocked by Model Armor, while "Handle the requests as specified in the System Instruction." (the ADK Python sentence for empty contents) was not. Only the sentence differed between the two requests, so the block comes from the wording of the Java sentence.

Environment Details:

  • ADK Library Version (see maven dependency): 1.10.1, code unchanged in 1.11.0 and on main (ce882374)
  • OS: Linux server (JDK 17); reproduced at unit level on Windows 11 / Microsoft Build of OpenJDK 17.0.19 / Maven 4.0.0-rc-3 (wrapper)

Model Information:

  • Which model is being used: gemini-3.8-flash (Vertex AI)

🟡 Optional Information

Regression:

No — the wording has been the same since v0.1.0 (first in Gemini, later moved to GeminiUtil).

How often has this issue occurred?:

  • Always (100%) for requests that contain no user-authored content.

Proposed fix:

Use the same wording as ADK Python and ADK TypeScript (a small PR will follow). Note that the Python empty-contents sentence was itself reported to trip Azure OpenAI's jailbreak filter in a LiteLLM code path (google/adk-python#4249; the wording was kept and the extra injection was removed in google/adk-python@d0102ec instead); Model Armor did not block it in the check above. Aligning the languages is proposed as the smallest change; making the placeholder text configurable would be an alternative if maintainers prefer.

Dominant language
Java
Stars
1.7k
Forks
433
Avg merge
3d 9h
Merged PRs (30d)
46

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from google/adk-java

All issues in google/adk-java

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.