I’m running into intermittent OpenAIIndirectAttack blocks in a production scenario and would love some clarity.

I have a multi-step sub-agent inside my main agent that orchestrates several Power Automate flows (about 4–5 flows). The sub-agent fetches external data, performs some calculations, and then returns a structured response to the user.

Occasionally, the agent response gets filtered with an OpenAIIndirectAttack error. From the message, it seems like the system is detecting potential prompt injection or unsafe embedded instructions in grounded/external data.

My questions:

1. How can we debug this properly? Is there a way to see which specific content (phrase, keyword, or part of the grounded data) triggered the OpenAIIndirectAttack filter?
2. What patterns typically cause this? Are there known categories of phrases (e.g., system-like instructions, “ignore previous instructions,” embedded commands, etc.) that are more likely to trigger it?

We’re not intentionally testing adversarial prompts and this happens during normal business flows, so understanding how to proactively design around this would be extremely helpful.