Agent security and prompt injection
An agent combines a model, tools and a decision loop. Text from pages, messages or documents may contain malicious instructions, known as prompt injection. Treat that content as untrusted data, not permission to act.
Security controls must exist outside the model: authentication, authorisation, parameter validation, restricted tools and confirmation for sensitive effects. Separate data and secrets, restrict network destinations where appropriate and keep proportionate logs. Asking a model to “ignore attacks” is not a sufficient security boundary.
A retrieved document asking to send a customer database to another address does not change an assistant’s permissions. The application must block the access and transfer regardless of the generated text.
The model may propose an action; the application must check whether it is allowed.
Try it yourself
Conduct an architecture review: draw data flows and trust boundaries, list permissions and external effects, propose adversarial tests, and define monitoring, owners, rollback and incident response. Request independent review.