10When agents read external content, that content may contain instructions designed to redirect behavior. The safest assumption is that untrusted text can influence a model. Architecture must contain the impact.
Treat content as data, not authority
Retrieved documents, emails, websites, and attachments should never outrank system policy. Applications should clearly separate trusted instructions from untrusted content and constrain how that content can affect tool use.
Content filtering can reduce risk, but it cannot guarantee that every hostile instruction is recognized.
Reduce the blast radius
Tools should expose narrow actions with validated inputs, not broad access to a shell or database. Credentials should match the task, and sensitive data should be minimized before it enters model context.
High-impact steps benefit from confirmation, transaction limits, and explicit policy checks outside the model.
Observe intent and action
Logging should connect the user request, retrieved context, model decision, tool call, and final outcome. That trace makes anomalous behavior detectable and incidents explainable.
Prompt injection is not solved by one classifier. It is managed through layered controls, least privilege, and operational visibility.