Untrusted content and prompt injection

An agent reads web pages, documents, tickets, emails and tool results. Any of those may contain text written by someone who wants the agent to do something its owner did not ask for. This is prompt injection, and its indirect form — where the attacker never talks to the agent, only leaves text where the agent will read it — is the one that matters for agents.

Say that in the system prompt, and mark untrusted content plainly when you insert it, so the boundary is visible in the context rather than implied. But do not rely on the prompt alone: a sufficiently well-crafted injection will sometimes win an argument with an instruction. The durable defence is that obeying it must not be enough.

That means the permission tiers from the previous lesson are your real protection. If sending mail requires a human confirmation, an injection that convinces the model to send mail achieves nothing on its own. If the agent has no refund tool, no amount of persuasive text produces a refund. Design so the worst case of a successful injection is a wasted turn and a log line.

One more habit: never let tool output decide what the agent is allowed to do. If a document says the reader has admin rights, that is a sentence in a document. Authority comes from your system, established before the run, and nothing read during the run can raise it.