How are you detecting new prompt injection patterns after launch?

I’d like to be able to detect the drift of a semantic pattern without creating an issue out of every single strange thing being reported.Trace-level safety scores can point out anything strange going on within retrievals, reasoning, and tool calls. Semantic search can help detect variations of any indirect injection that is known. The topic clustering can bring up a new group of probes. The problem with sampling the scores is that something very serious could be missed. Braintrust may be a possible choice we consider for safety scoring, semantic trace searching, sampled online evaluation, topic clustering, and elevation of suspicious traces to adversarial regression datasets. The hardware is the easy part to describe. Scorer thresholds and false positives are the actual operations problem. A research corpus can legitimately contain text about bypassing instructions and a model discussing an attack is different from a model obeying it. I think the attack taxonomy also needs to include behavior, not just payload wording. Did the agent expose a secret, widen tool scope, skip a confirmation step, or persist attacker controlled state across turns? How do you find new injection patterns after launch and what evidence is strong enough to promote a trace into the regression suite?