An AI agent may read webpages, documents, emails or tool results while carrying out a legitimate request. Those materials can also contain text that tells the agent to ignore its task, reveal information or take an unrelated action. This is prompt injection: an attempt to make lower-trust content influence the instructions or behavior of the application.
The risky content does not have to look malicious. It may be embedded in a page the agent was asked to summarize or in a document returned by search. The important distinction is where authority comes from. A document can provide facts for a task; it cannot grant itself permission to access a private system.
How An Injection Reaches An Agent
Suppose a user asks an agent to summarize a supplier's public documentation. The agent opens a page that includes a sentence directing it to send internal records elsewhere. That sentence is part of the source material, not a valid request from the user. The agent should continue with the authorized summary and avoid the unrelated action.
The same problem can appear in search results, retrieved documents, code comments and tool responses. It is especially consequential when the agent has tools that can read confidential data or make changes. An attacker may try to combine a misleading instruction with an available tool to produce a side effect.
Put Authorization At The Action Boundary
Give each tool the minimum access it needs, and check permissions in the application when the tool is called. A model's interpretation of a document is not a substitute for authorization. Limit which destinations can receive data, and validate the arguments of operations that change records or send messages.
For consequential actions, present a specific approval request to the user when appropriate. The reviewer needs to see the destination and the proposed content or change. A blanket instruction to be careful is weaker than a system that checks access and pauses before a sensitive operation.
Keep trusted task instructions distinct from external content in the application. Label source material and provide only what the task needs. These practices make boundaries clearer, but no prompt wording alone can guarantee that a model will ignore every adversarial instruction.
Reduce Exposure And Detect Problems
Use scoped credentials and isolate code execution where appropriate. Avoid putting unrelated secrets into the model's context. Filter or sanitize content when it helps the application, while recognizing that malicious instructions can be expressed in many forms and may not be caught by a simple keyword rule.
Log tool requests and outcomes in a privacy-conscious way. Monitor for unusual destinations, unexpected access attempts and actions that do not match the task. Make it possible to stop a run and investigate without collecting more user data than necessary. Our guide to agent observability explains how traces can support that work.
Test With Realistic Adversarial Cases
Include a retrieved page that asks the agent to abandon its task, a document that impersonates a system instruction and a tool result that requests an unauthorized data transfer. Verify not just the final answer but also the attempted tool calls. Test legitimate content too: a security article describing an attack should still be summarized as data.
Prompt injection is an ongoing risk to manage, not a problem solved by one filter. The OWASP prompt injection prevention guidance provides further defensive patterns. Combine those patterns with the specific permissions and failure modes of your application.
