Prompt Injection and AI Agent Security: What Actually Helps

A language model reads instructions and data in the same stream of text. It cannot reliably tell which words came from you and which came from an email, a web page or a file it was asked to summarise. When an attacker controls some of that text, they can try to give the model orders. This is prompt injection, and it is listed among the top risks for LLM applications in the OWASP project on LLM application security.

Why it is hard

Filters and "ignore malicious instructions" warnings help, but no known technique removes the problem entirely. Treat any defence that depends on the model behaving well as probabilistic. The safer approach is to design the system so that a hijacked model cannot do much harm.

The dangerous combination

Security researcher Simon Willison described a useful rule of thumb, the "lethal trifecta": an agent is at serious risk of data theft when it combines three things at once.

1. Access to private data.
2. Exposure to untrusted content.
3. A way to communicate externally (send email, make web requests, render images from URLs).

Remove any one leg and the attack gets much harder. If your agent reads customer emails (untrusted) and has your customer database (private), it should not also be able to send arbitrary messages or call arbitrary URLs.

Design rules that help

• Least privilege. Give each agent only the tools and data the current task needs. Read-only by default.
• Human approval for consequential actions. Sending messages, spending money, deleting data, changing permissions: a person confirms, seeing the exact action, not a summary.
• Separate untrusted content. Process untrusted text in a context that has no powerful tools, and pass only a constrained result (a label, a short summary, a structured field) to the privileged part.
• Constrain outputs. Validate structured output against a schema. Do not render model-produced links or images that could leak data in the URL.
• Allow-lists over deny-lists. Restrict which domains, commands and file paths tools can touch.
• Log and review. Keep a trace of tool calls so you can see what happened.

For coding agents specifically

Repositories contain text too: issues, README files, dependency docs, comments. An agent that reads them and can run shell commands is exposed to the same attack. Run agents in a sandbox, keep secrets out of their environment, and review dependency and permission changes by hand.

A short checklist

Before shipping an agent feature, ask: what is the worst thing it could do if an attacker wrote every word it reads? If the answer is unacceptable, remove a capability or add an approval step. The security review checklist on this site expands this into questions you can go through before launch.