Prompt-injection defence for AI agents

An AI agent reads things — emails, tickets, web pages, documents — and then takes actions. Prompt injection is what happens when something it reads contains instructions, and the model follows them.

For a chatbot, the result is an embarrassing answer. For an agent with tools, the result can be a payment, a deleted record or a leaked file. That is why defence for agents has to go beyond prompts.

Why filtering is not enough

It is tempting to scan inputs for phrases like "ignore previous instructions". It helps a little. But injections can be paraphrased, translated, encoded, split across documents or hidden in images. Treat detection as one layer, never the main control.

The more reliable stance: assume the model will sometimes be manipulated, and design the system so that a manipulated model has limited reach.

Five architectural controls

1. Typed, scoped tools

Give the agent narrow tools with schemas — invoice.lookup(id), not sql.execute(query). Each tool gets its own permissions, ideally the calling user's rather than a broad service account. No raw shell or database access.

2. Least privilege per task

An agent reconciling invoices does not need email-sending rights. Grant tools per workflow and per run, and expire them when the run ends.

3. Separate planning from untrusted content

Where possible, let a planner decide which steps to take before it sees untrusted content, and let a constrained component process the content without the ability to change the plan. Patterns such as dual-model or "quarantined" processing reduce how far injected text can travel.

4. Verification before writes

Before any write, an independent verifier — a rules engine, a second model with a narrow brief, or both — checks the proposed action against invariants: amounts within limits, recipients on an allow-list, records owned by the requester.

5. Humans at named moments

Irreversible or high-impact actions go to a named approver who sees the reasoning, the evidence and the exact proposed action on one screen. Approval gates are part of the design, not an afterthought.

Test like an attacker

• Build an injection test set: hidden instructions in documents, emails that impersonate executives, tool outputs that try to redirect the agent.
• Run it in CI on every change to prompts, tools or models.
• Measure attack success rate over time, and track which layer stopped each attempt.
• Map findings to the OWASP Top 10 for LLM Applications and MITRE ATLAS so risk teams can follow along.

Keep the evidence

Trace every run — inputs, retrieved sources, tool calls with arguments, model versions and decisions. When something goes wrong, the trace is how you prove what happened and fix it.

Prompt injection is not solved, and may never be fully solved at the model level. But agents built on typed tools, least privilege, verification and human gates can be safe enough to trust with real work. That is how we build them in our AI agents practice, and what we test for in AI security engagements.