The GenAI Prompt Contains Cryptographic Hash String rule detects hex-encoded cryptographic hash strings (MD5, SHA-1, SHA-256, SHA-512) that appear in GenAI prompts or model completions. It leverages the security_ai ML integration to analyze GenAI invocation events originating from AWS Bedrock and OpenAI ChatGPT Enterprise. A match is flagged when a hex digest is found in the inputMessages or outputMessages context, signaling potential credential exposure, data exfiltration, or prompt-injection payloads. The rule helps infer the hashing algorithm by length (32 -> MD5, 40 -> SHA-1, 64 -> SHA-256, 128 -> SHA-512) and focuses on the security_ai.hash_string.input_messages.strings (last user turn) and security_ai.hash_string.output_messages.strings (last assistant turn). It also considers the surrounding conversation to assess context, potential exfiltration, or credential references. The rule is mapped to MITRE ATT&CK T1110 (Credential Access) and MITRE ATLAS AML.T0057 (LLM Data Leakage) to reflect possible credential cracking and data leakage scenarios. False positives may arise from legitimate uses of hashes in CI/CD automation or threat intelligence workflows. Remediation guidance includes reviewing the surrounding context, revoking exposed credentials if present, and treating suspicious prompt-injection patterns as active threats, with cross-correlation to authentication and access logs. Setup requires the security_ai Fleet integration to enrich invocation events prior to enabling the rule.