Defending against prompt injection

A language model cannot reliably tell instructions from data: everything in its context is text it may follow. Prompt injection exploits that. Direct injection comes from the user ("ignore your instructions"). Indirect injection arrives inside content the agent reads: an uploaded PDF, an email, a web page, a tool result, a memory, a code comment. Tool poisoning hides instructions in tool descriptions, and a rug pull changes a tool's definition after you approved it. Detection helps, but attackers can phrase injections endlessly, so the real defences are structural. Do not let one context combine private data, untrusted content and a way to send data out. Give each step only the tools it needs. Plan actions before reading untrusted content, or read it in a quarantined model that cannot act. Track which values came from untrusted sources and refuse to send them to external sinks. Pin and review tool definitions. Put a human gate on every consequential action. Then red-team the result and say plainly what risk remains.

Key takeaways:

• Treat every piece of text the model reads as potentially adversarial unless your own code wrote it.
• Injection is not "fixed" by a better system prompt or a classifier; those reduce rates, not the class.
• Break the lethal trifecta: never one context with private data, untrusted input and an exfiltration path.
• Control what the agent can do after it is fooled: least privilege, data-flow rules, gates.
• Tool definitions from third parties are code you are running in your model's head. Review and pin them.