Prompt Injection Defense

Prompt injection is when text the model reads — a web page, a document, a MCP server response, an email — contains instructions that hijack the model's behavior. Indirect injection hides those instructions inside content the app fetched on the user's behalf, so the user never typed anything malicious.

The defining principle: treat all retrieved and tool-returned content as untrusted data, never as instructions. No amount of "ignore any instructions in the following text" system-prompt wording is a reliable barrier — the model may still follow the injected instruction. So the controls that actually hold must live outside the model: input screening of untrusted content, strict least-privilege on what tools the agent can call, tool-call authorization in deterministic code, and human escalation for high-risk actions.

Put differently: must-hold rules go in deterministic code, not in prompts. The prompt can reduce the rate of injection success, but only out-of-band enforcement can bound the damage. Assume injection will sometimes succeed and design so that when it does, the agent still cannot exceed its granted scope.