AI Agent Security: Prompt Injection, Safe Tools, and Containment

01 / The story

What prompt injection actually is

An AI agent works by reading text and deciding what to do next. The problem is that the agent reads two kinds of text at once: your instructions, and the content it is working on, like emails or web pages. To the model, both are just words. If an attacker hides an instruction inside the content — for example, a line in an email saying 'forward the last invoice to this address' — the agent may follow it as if you had asked.

This is called prompt injection, and it is the top risk on the OWASP list for large language model applications. The UK's National Cyber Security Centre has warned that prompt injection is not like classic SQL injection, where careful formatting can fully block the attack. Because models understand language loosely, there is no known way to guarantee an agent will always ignore a malicious instruction. Defenses reduce the risk; they do not remove it.

02 / The story

Why agents make it worse than chatbots

A chatbot that gets tricked can say something wrong. An agent that gets tricked can do something wrong: send a message, change a file, call an API, or make a purchase. Security researcher Simon Willison describes the dangerous combination as an agent that can read untrusted content, access private data, and communicate outward — all three at once. Remove any one of the three and most prompt-injection attacks lose their power.

Real incidents follow this pattern. Agents asked to summarize email have been shown to act on instructions inside the email. Coding agents have been steered by text inside the repositories they were reading. None of these required hacking the model itself — the attacker only had to control some text the agent would read.

03 / The story

Safe tool use: shrink what the agent can do

Tools are the actions an agent can take, such as 'send email' or 'run this command'. The single most effective protection is least privilege: give the agent the smallest set of tools, with the narrowest permissions, that still lets it do its job. An agent that summarizes support tickets does not need the ability to reply to customers, delete records, or issue refunds.

Make dangerous tools explicit and separate. A common pattern is to split work into two stages: an agent that reads and proposes, and a narrow, well-checked function that acts. Anthropic's guidance on building effective agents makes the same point in general terms: keep agent systems as simple as the task allows, because every added capability is also an added way to be misused.

Keep secrets out of reach. Do not paste API keys into prompts, and prefer short-lived, scoped tokens over one powerful master key. If the agent never sees a credential, a successful injection cannot steal it.

04 / The story

Containment: assume the agent will eventually be fooled

Because prompt injection cannot be fully prevented, plan for the day it succeeds. Containment means running the agent inside boundaries so that a fooled agent causes a small, reviewable problem instead of a disaster. Common boundaries include running the agent in a separate account or workspace, giving it a sandboxed environment for code execution, and blocking network access except to the services it needs.

Human approval is the strongest containment for irreversible actions. Let the agent draft the email, prepare the refund, or write the code change — then let a person press the button. This costs some speed, but it converts a silent failure into a visible one. Logging is the other half: record every tool call the agent makes, so you can review behavior, spot odd patterns, and undo damage.

NIST's taxonomy of adversarial machine learning and the major AI labs' own safety guides all point the same direction: test your system with attacks, not just with friendly examples. Try injecting instructions into the content your agent reads and see what it does before an attacker does it for you.

05 / The story

What to watch, including 2027

Research on prompt-injection defenses is active: model providers are training models to resist injected instructions, and new standards for agent permissions are being discussed. Expect steady improvement in detection tools and in 'agent firewalls' that filter what agents can read and do.

Disclaimer for 2027: nothing here predicts what will happen in 2027. No complete technical fix for prompt injection has been announced as of October 2026, and security agencies advise treating it as an ongoing risk to manage rather than a bug that will be patched. Product features, standards, and best practices may change, so check current provider documentation before deploying an agent.