← Community

Defend Against Prompt Injection

Treat every piece of fetched content as untrusted input and design the agent so a malicious document cannot escalate into a real action. Use when an agent reads web pages, email, files, or any third-party data.

---
name: defend-against-prompt-injection
category: ai-agents
description: >-
  Treat every piece of fetched content as untrusted input and design the agent so
  a malicious document cannot escalate into a real action. Use when an agent
  reads web pages, email, files, or any third-party data.
---

# Defend Against Prompt Injection

The moment an agent reads content it did not author — a web page, an email, a
PDF, a code comment, a tool result — that content is in the same context window
as your instructions. Text is text. The model has no reliable way to tell your
orders from orders embedded in the material.

This is not a bug you patch. It is a property of putting untrusted text next to
privileged instructions, and it is why **the fix is architectural, not textual**.

## Why "just tell it to be careful" fails

The common first attempt is a line in the system prompt saying to disregard
instructions found in documents. It helps a little and fails often, because:

- The attacker writes as much text as they like, and can place it after yours.
- Injections do not have to look like commands. A document can contain a
  plausible "note from the operator", a fake tool result, or a code comment that
  reads like policy.
- The model is optimised to be helpful, and an injection is phrased as a request
  for help.

Treat prompt-level defences as friction, never as a boundary.

Shared publicly by the author and open for any use. See the Terms.