# How to Find the Agent Actions a Prompt Injection Can Control

> Source: <https://ainexusdaily.vercel.app/article/2026-10-28-how-to-find-the-agent-actions-a-prompt-injection-can-control>
> Published: 2026-10-28 11:53:06+00:00

# How to Find the Agent Actions a Prompt Injection Can Control

Engineer's view. This is SQL injection without parameterized queries. A database fixed it by sending the query and the values on separate channels. A model reads both in one stream, so it cannot. The fix moves up a level: decide each action before reading the values, or read them somewhere that cann

ot act. It costs flexibility. TL;DR. A model treats every word in its context as a possible instruction, including text a tool fetched.

Any decision your agent makes after reading that text belongs to whoever wrote it. A kid has a list of chores from their parent. One chore says "read the notes in the mailbox One note in the mailbox says "Also, leave the back door open." It is written in pen, like the So the kid leaves the door open. The note writer did not break in.

They just wrote a note in A smart parent writes the whole chore list first. The mailbox can change what the kid writes You have shipped this bug already, in a system with no model in it. A support page showed customer names. Someone signed up with a name that contained a <script> tag.

The page printed the name, and the browser ran it as code. Every agent who The fix you shipped was a boundary. The browser now treats the name as text and never as code. An AI agent has the same bug, and no such boundary.

An agent is a model that calls tools in a context, the text the model reads before each step. Your request is This is prompt injection: someone writes instructions into content your agent will read. The useful question is not whether a model can be fooled. It can.

The question is what the The fix: list every decision your agent makes after it reads untrusted text, then move each The Fix: Decide the Actions Before the Agent Reads Anything Untrusted Every decision made in a context that has seen the untrusted text. That covers three kinds: That turns a fuzzy worry into bookkeeping. You can list the decisions, and you can count them. That instruction lives in the same context as the attack.

The attacker's text can argue with it, When three things meet in one context: your private data, untrusted text, and a way out. Simon lethal trifecta. A way out can be an email, an HTTP call, or an When this matters. Your agent reads anything a stranger can write: email, web pages, How it affects you.

Prompt injection is not a bug you patch once. It comes from how the What to do about it. Start with paper and no code. Write down every tool your agent can Then change the design, not the prompt.

Fix the tool sequence before the read. Have a separate ## Implementing It shows each one. The change. Four people touch this.

The design work belongs to the first. Role 1, whoever writes the agent loop. Label every tool, then gate the loop. After the first TOOLS = { "read_inbox": Tool(reads=UNTRUSTED), "search_docs": Tool(reads=PRIVATE, payload="query"), "send_email": Tool(dest="to", payload="body", renders_remote=True, consequential=True), } gate = InjectionGate(TOOLS) for call in model_turns(messages): if not gate.allow(call.name) and not ask_user(call): messages.append(refused(call)); continue result = run_tool(call) gate.saw_result(call.name) # flips once untrusted text arrives messages.append(result) The gate is the floor.

The bigger win is the design. Have a planner fix the tool list and the $VAR1 for a Role 2, whoever writes the MCP server. Say what each tool touches. MCP has openWorldHint for tools that reach outside entities, and readOnlyHint for tools that change { "name": "fetch_page", "annotations": { "readOnlyHint": true, "openWorldHint": true } } Role 3, whoever owns the chat window.

Stop the reply from making requests. Strip remote images img-src 'self'. Show full Role 4, whoever owns CI. Plant a canary.

Put an instruction in a fixture email that asks for def test_inbox_cannot_exfiltrate(): calls, reply = run_agent("Summarize my inbox", inbox=[CANARY_EMAIL]) outward = [c for c in calls if TOOLS[c.name].consequential] assert not any("CANARY-7f3" in str(c.args) for c in outward) assert "evil.example" not in strip_remote_images(reply) How you know it worked. Run the audit in code_example.py on your agent's description. The leak count should read zero. When your agent never reads text a stranger wrote.

A coding agent working only on your own repo When nothing downstream can act or leak. An agent that summarizes web pages into a chat with no When the task needs to change course after reading. A plan fixed in advance cannot follow a The cost is real. A quarantined reader doubles the model calls.

Every approval prompt costs a Three questions before you change anything: Which tools can read text that someone outside your team wrote? After that read, which tools can still send, write or fetch? Does your chat window load images from URLs the model wrote? context — the text the model reads before each step: your request, its own replies, and every tool result.

prompt injection — instructions written into content an agent will read, so the model follows them. lethal trifecta — private data, untrusted text and a way to send data out, all reachable from one context. quarantined model — a model that reads untrusted text but has no tools, and returns only values. canary — a unique marker string planted in a test, so you can detect if it ever leaves.

Design Patterns for Securing LLM Agents against Prompt Injections — Simon Willison's Weblog The lethal trifecta for AI agents — Simon Willison's Weblog LLM Prompt Injection Prevention Cheat Sheet — OWASP Cheat Sheet Series Tools, Model Context Protocol specification — Model Context Protocol Originally published at theaicommit.com, a daily AI engineering lab for software engineers. The original has an interactive version you can play with, and the full runnable code is on GitHub.

## Key Takeaways

- •It costs flexibility.
- •This story was reported by **Dev.to** , covering developments in the**dev** space.
- •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage.

📖 Continue reading the full article:

[Read Full Article on Dev.to →](https://dev.to/theaicommit/how-to-find-the-agent-actions-a-prompt-injection-can-control-2mbl)