Direct answer: Treat untrusted content as control-plane input. Constrain blast radius with least-privilege tools, pre-execution policy checks, content isolation, human approval for high-risk actions, and immutable audit logs, rather than relying on input filters alone.
Why prompt injection is an agent runtime problem
Prompt injection manipulates large language model control flow through natural language rather than through structured query or command syntax. OWASP classifies it as LLM01, the top risk for LLM applications, covering both direct instruction override and indirect injection via external content. In enterprise agents, the model is not only answering questions. It plans, retrieves, and invokes tools. That turns a successful injection into unauthorized API calls, data exfiltration, privilege escalation in connected systems, or bypass of intended safety instructions.
Traditional input attacks target parsers and interpreters with special characters or encoded payloads. Prompt injection targets instruction priority: the model is asked to treat attacker-supplied text as higher authority than system or developer policy. Filtering and prompt hardening help but do not close the problem. Untrusted text will still enter the context through users, RAG corpora, browsers, email, documents, and tool responses. Security engineering therefore has to assume some injections will succeed and constrain what the agent can do when they do.
Direct, indirect, and prompt-leaking attacks
Direct prompt injection places adversarial text in the user message channel. Typical patterns tell the model to ignore prior instructions, adopt a new persona, reveal hidden policies, or execute a different task sequence. Impact scales with the permissions attached to the session: a chat-only bot may emit unsafe text; an agent with tools may act on the override.
Indirect prompt injection embeds instructions in data the model later retrieves or processes. Web pages, uploaded documents, email bodies, ticket threads, and knowledge-base chunks can carry hidden directives that the model treats as authoritative once they appear in context. The user may never type the malicious text. The agent fetches it as part of normal work, which is why RAG pipelines and content connectors are high-value attack paths.
Prompt-leaking attacks aim at disclosure rather than immediate action. They try to extract system prompts, tool schemas, hidden policies, or connector configuration. Leaked control text improves follow-on direct and indirect attacks and reveals internal trust boundaries. In practice these three classes often combine: a leak informs a crafted document, which later drives an unauthorized tool call.
Runtime control surface
Instruction paths (user prompts, system policy, and retrieved content) compete in one context window. Policy checks must gate tool arguments, destinations, and egress before execution. Prompts, retrievals, tool calls, and decisions need immutable audit records.
High-risk components and data paths
Injection exposure concentrates where untrusted content and powerful actions meet. Architectures that concatenate trusted instructions and untrusted retrieval into one context window create instruction-boundary failures. Tool-calling loops amplify impact because injected text can trigger external side effects.
Layered runtime controls that limit impact
Input-side filtering and prompt hardening alone are insufficient. Residual risk must be managed with runtime controls on permissions, data access, and egress. Start by separating trusted system and developer instructions from untrusted user and retrieved content architecturally, not only with prompt wording. Summarize or redact untrusted sources before they reach the planner or actor model where feasible, and mediate browser, email, and document parsers so raw content is not freely concatenated into the control context.
Apply least-privilege, scoped credentials and allow-lists to every tool the agent can invoke. Enforce authorization, data-classification, and egress rules at the tool-call boundary before execution, independent of what the model emitted. Require human-in-the-loop approval for high-risk actions such as external egress, destructive operations, or access to sensitive stores, and make those gates mandatory by policy rather than optional UI prompts.
Strip or neutralize instruction-like patterns in retrieved content where practical, while accepting that perfect sanitization is unreliable across models and attack craft. Continuously red-team direct, indirect, and multi-stage paths across RAG and tools. Maintain immutable audit logs of prompts, retrieved chunks, model outputs, tool calls, and policy decisions so detection, forensics, and compliance review have a complete evidence trail.
Implementation and governance practices
- Policy at the tool boundary: Evaluate tool arguments, identity, purpose, and destination against allow/deny rules before any side effect runs.
- Scoped agent permissions: Issue narrow credentials per tool and per workflow; avoid broad identities shared across agents or tenants.
- Mandatory human approval: Bind high-risk action classes to approval workflows that cannot be waived by model-generated justification alone.
- Connector and MCP review: Treat third-party MCP servers and external tool catalogs as supply-chain components requiring security review and least privilege.
- Auditability by default: Retain queryable records of retrieval, model output, tool calls, and policy outcomes for incident response and compliance.
- Continuous injection testing: Run red-team suites that cover user-channel, retrieval-borne, and tool-output injection, including multi-step chains.
Tradeoffs security teams should expect
No standardized detection signature covers all prompt-injection variants. Filter efficacy varies by model and attacker craft, and public guidance continues to evolve. Strict isolation and summarization of untrusted content can reduce injection success but may discard details the business needs. Aggressive tool allow-lists and human approval lower blast radius while adding latency and operational load. MCP and similar tool-bus protocols are relatively new; long-term baselines are still consolidating, so treat external tool catalogs as changing supply-chain risk.
The practical objective is not zero residual injection risk. It is bounded impact: the agent may mis-rank instructions under adversarial content, but it cannot freely choose tools, destinations, or data egress outside policy. Runtime policy enforcement, least privilege, approval gates, and audit logging are the compensating controls that make that bound enforceable.