Defending agents against prompt injection from web pages and documents

Symptoms

• After reading a web page or issue, the agent starts doing things unrelated to the task
• Tool output contains text like “ignore previous instructions”

Common causes

• External content and user instructions share one context
• The same agent can both read untrusted content and perform sensitive actions

How to fix

1. Least privilege: an agent that reads external content gets no write access to email, code pushes or payments, or needs human approval
2. Require human approval for every irreversible action such as posting, sending or deleting
3. Filter obvious injections and data exfiltration with input/output scanners such as LLM Guard
4. Red-team before launch with tools like garak and PurpleLlama to see how susceptible the model is
5. Keep full traces so you can find which external content triggered a problem

Notes

• Scanners reduce risk; they do not catch every injection