Prompt injection is when text that a model reads — a support ticket, a PDF, a web page, an email, a tool result — contains instructions that the model follows as though they came from its operator. It is listed first in the OWASP Top 10 for LLM applications, and it is not a bug that a better prompt will fix.
Why filtering does not work
Instruction-shaped text arrives through every channel an agent reads, in every language, encoded and paraphrased in ways no filter anticipates. Detection can reduce the noise, but a defence that depends on recognising every attack will eventually miss one. Treat any text the model reads from outside as untrusted, and assume some of it will be hostile.
The control that holds is the permission boundary
If an agent does not have permission to call a tool, no instruction in any document can make it call that tool. The question to ask of every agent is therefore not "can it be tricked?" — assume it can — but "what is the worst it can do when it is?"
- Separate read permissions from write permissions, and give each tool the narrowest scope that does its job.
- Do not give one agent both access to sensitive data and a way to send data outside — such as email, web requests or chat messages.
- Require a person to approve anything that moves money, changes access or contacts someone on your behalf.
- Run tools with the permissions of the user the agent is acting for, never with an all-powerful service account.
Test it like an attacker would
A security review of an AI feature should try injection through every input the model reads, including the indirect ones: documents retrieved for context, results returned by other tools, and content fetched from the web. Each finding should come with a working example, because "the model might" is much easier to dismiss than a demonstrated data leak.
Keep the trail
Log every tool call with the input that triggered it and the content the model had in front of it at the time. When something unexpected happens, that record is the only way to tell an injection from a bug, and the only way to show an auditor or a customer what happened.
A practical order of work
For a team shipping an agent, the order is: decide which actions need a human, split permissions so no single path combines sensitive data with an outbound channel, add logging, and then test with injection attempts through every channel. Prompt hardening is worth doing, but it belongs last on that list, not first.