Why it matters
Prompt injection turns ordinary content into an instruction path. In agentic systems, that can affect customer data, internal tools, outbound messages, code changes, or operational decisions.
Open the full category guideRecommended controls
- Separate instruction from contentUse structured message boundaries, trusted-system prompts, and content wrappers so retrieved or user-controlled text is never treated as policy.
- Constrain tool authorityUse server-side action policies, least-privilege tools, approval gates, and deny-by-default behavior for high-impact operations.
- Test indirect inputsRun regression probes across RAG documents, webpages, email, issue trackers, and tool output, not only the chat box.
