User-controlled instructions
A user message tries to redefine role, policy, data access or the actions the model may request.
Field guide / agentic input integrity
AI agent prompt injection defense: contain untrusted instructions before they become actions.
Prompt injection is not only a chat problem. In an agent, untrusted text, images, tool output or memory can influence a model that also holds data and can act. The defensible objective is to keep manipulated model behavior from becoming unauthorized impact.
Direct answer
Assume the model can be influenced; constrain what follows
No prompt, classifier or content filter proves prevention. Separate untrusted content from authority, keep credentials and state changes in trusted application code, apply least privilege at execution time, require exact confirmation for high-impact actions, protect durable memory writes and verify the deployed behavior with adversarial cases.
Direct, indirect, persistent and multimodal paths
Retrieved content
A web page, document, email, search result, RAG passage or issue title contains content that acts like instructions.
Tool output re-enters context
An MCP server, API or sub-agent returns untrusted content that influences a later call under broader authority.
Memory or corpus poisoning
A tainted write survives the current run and influences later sessions, users or agents that read the same store.
Instructions outside visible text
Images, audio, video, metadata, encoded text or invisible characters alter what reaches a multimodal model or downstream renderer.
Low privilege plants high-impact context
A public form, support ticket or repository contribution places content where an elevated internal agent will later read it.
Seven load-bearing defenses
Inventory every ingress
Map direct prompts, retrieval, files, web pages, messages, databases, tool results, media, history and memory. Record who controls each source and how its content propagates.
Preserve provenance and trust
Carry source, owner, retrieval time and trust classification alongside content. Structural separation can help analysis, but it is not proof that the model will obey the label.
Keep authority outside the model
Store credentials and state-changing capability in trusted application code. Grant the smallest operation-specific scope instead of ambient access shared across the whole agent loop.
Mediate every side effect
Validate the proposed action, typed arguments, target, data class, scope and destination in deterministic code immediately before execution. A schema-valid action can still be unsafe.
Budget capability combinations
Treat the combination of untrusted input, sensitive data and external communication or state change as high risk. Remove a capability, narrow it per action or require an explicit human decision.
Treat memory writes as privileged operations
Log the causing input and provenance, separate facts from instructions, review authority-changing content and make durable records attributable, inspectable and revocable.
Exercise the deployed boundary
Test direct, indirect, chained, persistent and multimodal cases with synthetic data. Include an adaptive reviewer who knows the controls, then verify actual tool, egress, memory and approval behavior.
Where each control proves its value
Reduce and label exposure
Minimize retrieved content, normalize encodings where appropriate, preserve provenance and remove unnecessary private data from the context.
Constrain the model's job
Use narrow instructions and typed outputs as partial controls. Do not mistake either for an authorization boundary.
Re-authorize the exact effect
Apply deterministic policy, least privilege, destination allowlists, idempotency and action-time confirmation outside the model.
Detect, revoke and learn
Record the decision and side effect, make memory writes reversible, prove stop paths and convert observed failures into regression cases.
Evidence to verify
- An ingress map that includes direct prompts, retrieval, tools, media, history and durable stores.
- Runtime traces showing source provenance survives into the decision and evidence record.
- Policy-engine tests that reject unauthorized actions even when the model proposes valid-looking arguments.
- Per-operation scopes, destination controls and proof that revoked authority no longer works.
- Memory-write records with actor, source, reason, review state and a tested removal path.
- Human approval screens that show the exact action, target and data rather than a model-written summary.
- Regression cases covering direct, indirect, chained, cross-session and multimodal input paths.
Safe verification plan
Start with an isolated environment, synthetic identities and data, inert destinations and no production credentials. Define expected decisions and stop rules before introducing adversarial content. Use the smallest proof that shows whether authority, memory, egress or approval can cross its stated boundary.
A useful result states the path, control, observed behavior, evidence, limitation and residual risk. A blocked payload does not prove general immunity; a detector score does not prove that a privileged action is unreachable.
Need a bounded control review?
Start with the five-minute readiness checklist → or prepare the incident path before testing →
Safety boundaries
- Defensive work only, on systems owned by the requester or explicitly authorized in writing.
- Active testing requires written Rules of Engagement with exact assets, inputs, data handling, timing, contacts and stop conditions.
- Use synthetic data and inert destinations by default; stop on unexpected sensitive or third-party access.
- No denial of service, destructive testing, persistence, social engineering or third-party targeting by default.
- This guide is not a certification, a guarantee of prevention or permission to test a system you do not own.
Primary sources and further reading
OWASP Top 10 for LLM Applications 2026 — LLM01 Prompt InjectionOfficial release ↗NIST AI 600-1 — Generative AI ProfilePrimary source ↗NIST prompt injection definition — AI 100-2e2025Primary source ↗MITRE ATLAS — LLM Prompt Injection and agentic techniquesLiving knowledge base ↗AI agent security controls baselineSelect evidence ↗AI agent threat modeling guideMap the attack path ↗AI agent incident response guideContain and recover ↗
Direct answers
What is prompt injection in an AI agent?
Prompt injection happens when direct input, retrieved content, tool output, media or persistent memory changes model behavior in a way the application owner did not intend. In an agent, the risk becomes more consequential when that changed behavior can reach tools, credentials, private data or external destinations.
Can prompt injection be prevented completely?
No current prompt, classifier or content filter proves complete prevention. Treat detection as one layer and design the surrounding system so a manipulated model cannot silently obtain broad authority, expose private data, persist instructions or perform high-impact actions.
What is indirect prompt injection?
Indirect prompt injection arrives through content the model reads rather than a direct user command: for example a web page, email, document, search result, RAG passage, issue title, image, database row or tool response. The content is data to the user but may act like instructions to the model.
How should an agent protect long-term memory from prompt injection?
Treat durable memory writes as privileged operations. Preserve the causing input and provenance, validate the proposed record in trusted code, separate facts from instructions, require approval for authority-changing content and make every write reviewable and revocable.
Can Delx Security test prompt-injection controls?
A bounded review can evaluate an authorized system with synthetic inputs and the smallest sufficient proof. Active testing begins only after written Rules of Engagement define exact assets, techniques, data handling, timing, contacts and stop conditions.