Practical guidance on securing AI agents, tools, and the systems they act on, written by the team building the trust layer for AI agents.
Handling untrusted instructions means deciding in advance which content sources can influence behavior and enforcing that decision outside the model's judgment.
Jailbreaking manipulates a model into bypassing its own trained safety behavior; prompt injection redirects a specific application's task, and the two need different tests.
Prompt leaking exposes system instructions, business logic, and sometimes embedded secrets, and the fix is keeping sensitive material out of the prompt, not hiding it better.
Prompt injection can cause data exfiltration by convincing a model to include sensitive context in its response or to send it through a tool the model can call.
Defense in depth for prompt injection means layering prompt structure, content filtering, tool scoping, authorization, and output validation, so no single failure is fatal.
Testing for prompt injection means attacking every content path a model reads, not just the chat box, and checking whether enforced boundaries hold, not just the model's reply.
Prompt engineering can reduce the success rate of prompt injection but cannot eliminate it, so it belongs alongside enforcement controls, not instead of them.
A system prompt is a strong suggestion the model usually follows, not an enforced boundary, and treating it as one leaves security rules with no real backing.
Web pages, documents, and email are the three most common carriers of indirect prompt injection, each with distinct techniques attackers use to hide instructions.
Indirect prompt injection reaches agents through retrieval, browsing, email, tool responses, and shared memory, each path needing its own specific control.
Direct prompt injection comes from the user typing an override; indirect injection arrives through content the model processes, and the second is harder to test for.
Prompt injection is content crafted to override a model's intended instructions, exploiting the fact that models interpret all text they receive as potentially authoritative.
