Hey, thanks for the report. I can see the screenshot showing PII detection, and I get that this is a serious issue for a security-critical use case.
This is a known bug. When beforeSubmitPrompt returns continue: false, the blocked message still stays in the conversation history and gets sent on the next turn. The team is aware, and your report helps with prioritization.
Current workaround: after a block, start a new chat. This clears the context and prevents the blocked content from leaking. Not ideal, but it’s the only reliable option right now.
Related thread for context: Blocked messages (BeforeSubmitPrompt hook returns continue: false) are still included in later LLM context/history
Let me know if you have any questions.