Operations & Security

Prompt Injection Defense Checklist for AI Agents.

A defense guide for AI agents that read external content and run tools, covering trust boundaries, permissions, approvals, and logging to reduce prompt injection risk.

Step-by-step instructions

  1. 1

    Separate external content as data, not commands

    Set an input boundary so that text read from web pages, documents, and emails is not executed with the same authority as system instructions.

  2. 2

    Minimize tool permissions per task

    Separate actions with different impact, such as read, write, send, and pay, and remove unneeded tokens, files, and network access.

  3. 3

    Require human approval for high-risk actions

    Add an explicit approval step so that external sends, posts, deletions, and permission changes are not executed on the agent's judgment alone.

  4. 4

    Log inputs and actions, and test

    Record tool calls, approvals, and failure causes, and regularly check that typical bypass instructions are blocked when they come in.

Don't let what it reads become an instruction

Prompt injection can make an agent trust adversarial text inside the web pages or documents it processes and drift from its original purpose. Treat external text as data, and separate system instructions from tool permissions.

Don't rely on a single layer of filtering

A model's refusal alone is not enough. Layer least privilege, approval for risky actions, limits on sensitive tool results, and monitoring so that if one defense fails, the damage is contained.

Match approval points to the impact of the action

A simple lookup and an external send, post, or deletion are not the same level of permission. Require human confirmation for actions that are hard to undo, and record why the agent wants to run them and what the target is.

Official resources: Anthropic prompt-injection defenses · Trustworthy agents in practice