Evidence-first authority page
Prompt Injection Defense for AI Agents
Why prompt injection is an unsolved, structural risk for any agent that reads untrusted content, and the practical mitigations available today.
Direct answer
Prompt injection — text embedded in content an agent reads that's designed to be mistaken for instructions — has no complete technical fix as of today; the practical mitigation is treating all externally-sourced content as data rather than instructions, constraining what actions the agent can take based on that content, and requiring human approval for consequential actions triggered by untrusted input.
Last reviewed 2026-08-29
This page remains noindex while its page-level source receipts are completed and verified. It is available for review, not presented as publication-ready authority.
Why this is structural, not a bug to patch
A language model processes its instructions and the content it's asked to work with in the same channel — text. There's no hard boundary in the underlying architecture that guarantees the model treats 'read this webpage' and 'the webpage's own embedded text' with different levels of trust. This is an open, actively-researched problem across the industry, not a solved one any single vendor has fully closed.
Practical mitigations available today
- Least-privilege tool access — an agent that can only read, not act, has a much smaller blast radius if it's tricked by injected content.
- Human approval for any action triggered by content the agent didn't originate itself (a webpage, an email, a file from an untrusted source).
- Separating the 'instructions' channel from the 'data' channel as much as the client/framework allows, and being skeptical of frameworks that claim to have fully solved this.
- Output filtering — checking an agent's proposed action against an allowlist before executing it, rather than trusting the model's own judgment alone.
Where the risk is highest
Any agent that combines (a) reading untrusted external content and (b) having permission to take a consequential action (send an email, execute code, make a purchase, modify data) carries the highest injection risk. An agent that only reads and summarizes, with no action permissions, has a much smaller practical risk surface even if it's still technically susceptible to injected text.