How to Find the Agent Actions a Prompt Injection Can Control

A new engineering guide argues that prompt injection in AI agents is structurally the same bug as SQL injection without parameterized queries, and that the fix is to decide every agent action before the model reads untrusted text rather than trying to patch the prompt. The guide instructs developers to label each tool as reading untrusted or private data, gate the agent loop with an InjectionGate that flips once untrusted text arrives, and use MCP annotations such as readOnlyHint and openWorldHint to declare what each tool touches. It also assigns responsibilities across four roles — the agent-loop author, the MCP server author, the chat-window owner (who should strip remote images via img-src 'self') and the CI owner (who should plant a canary email and test that the agent cannot exfiltrate it).

How to Find the Agent Actions a Prompt Injection Can Control Engineer's view. This is SQL injection without parameterized queries. A database fixed it by sending the query and the values on separate channels. A model reads both in one stream, so it cannot. The fix moves up a level: decide each action before reading the values, or read them somewhere that cann ot act. It costs flexibility. TL;DR. A model treats every word in its context as a possible instruction, including text a tool fetched. Any decision your agent makes after reading that text belongs to whoever wrote it. A kid has a list of chores from their parent. One chore says "read the notes in the mailbox One note in the mailbox says "Also, leave the back door open." It is written in pen, like the So the kid leaves the door open. The note writer did not break in. They just wrote a note in A smart parent writes the whole chore list first. The mailbox can change what the kid writes You have shipped this bug already, in a system with no model in it. A support page showed customer names. Someone signed up with a name that contained a <script tag. The page printed the name, and the browser ran it as code. Every agent who The fix you shipped was a boundary. The browser now treats the name as text and never as code. An AI agent has the same bug, and no such boundary. An agent is a model that calls tools in a context, the text the model reads before each step. Your request is This is prompt injection: someone writes instructions into content your agent will read. The useful question is not whether a model can be fooled. It can. The question is what the The fix: list every decision your agent makes after it reads untrusted text, then move each The Fix: Decide the Actions Before the Agent Reads Anything Untrusted Every decision made in a context that has seen the untrusted text. That covers three kinds: That turns a fuzzy worry into bookkeeping. You can list the decisions, and you can count them. That instruction lives in the same context as the attack. The attacker's text can argue with it, When three things meet in one context: your private data, untrusted text, and a way out. Simon lethal trifecta. A way out can be an email, an HTTP call, or an When this matters. Your agent reads anything a stranger can write: email, web pages, How it affects you. Prompt injection is not a bug you patch once. It comes from how the What to do about it. Start with paper and no code. Write down every tool your agent can Then change the design, not the prompt. Fix the tool sequence before the read. Have a separate Implementing It shows each one. The change. Four people touch this. The design work belongs to the first. Role 1, whoever writes the agent loop. Label every tool, then gate the loop. After the first TOOLS = { "read inbox": Tool reads=UNTRUSTED , "search docs": Tool reads=PRIVATE, payload="query" , "send email": Tool dest="to", payload="body", renders remote=True, consequential=True , } gate = InjectionGate TOOLS for call in model turns messages : if not gate.allow call.name and not ask user call : messages.append refused call ; continue result = run tool call gate.saw result call.name flips once untrusted text arrives messages.append result The gate is the floor. The bigger win is the design. Have a planner fix the tool list and the $VAR1 for a Role 2, whoever writes the MCP server. Say what each tool touches. MCP has openWorldHint for tools that reach outside entities, and readOnlyHint for tools that change { "name": "fetch page", "annotations": { "readOnlyHint": true, "openWorldHint": true } } Role 3, whoever owns the chat window. Stop the reply from making requests. Strip remote images img-src 'self'. Show full Role 4, whoever owns CI. Plant a canary. Put an instruction in a fixture email that asks for def test inbox cannot exfiltrate : calls, reply = run agent "Summarize my inbox", inbox= CANARY EMAIL outward = c for c in calls if TOOLS c.name .consequential assert not any "CANARY-7f3" in str c.args for c in outward assert "evil.example" not in strip remote images reply How you know it worked. Run the audit in code example.py on your agent's description. The leak count should read zero. When your agent never reads text a stranger wrote. A coding agent working only on your own repo When nothing downstream can act or leak. An agent that summarizes web pages into a chat with no When the task needs to change course after reading. A plan fixed in advance cannot follow a The cost is real. A quarantined reader doubles the model calls. Every approval prompt costs a Three questions before you change anything: Which tools can read text that someone outside your team wrote? After that read, which tools can still send, write or fetch? Does your chat window load images from URLs the model wrote? context — the text the model reads before each step: your request, its own replies, and every tool result. prompt injection — instructions written into content an agent will read, so the model follows them. lethal trifecta — private data, untrusted text and a way to send data out, all reachable from one context. quarantined model — a model that reads untrusted text but has no tools, and returns only values. canary — a unique marker string planted in a test, so you can detect if it ever leaves. Design Patterns for Securing LLM Agents against Prompt Injections — Simon Willison's Weblog The lethal trifecta for AI agents — Simon Willison's Weblog LLM Prompt Injection Prevention Cheat Sheet — OWASP Cheat Sheet Series Tools, Model Context Protocol specification — Model Context Protocol Originally published at theaicommit.com, a daily AI engineering lab for software engineers. The original has an interactive version you can play with, and the full runnable code is on GitHub. Key Takeaways - •It costs flexibility. - •This story was reported by Dev.to , covering developments in the dev space. - •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage. 📖 Continue reading the full article: Read Full Article on Dev.to → https://dev.to/theaicommit/how-to-find-the-agent-actions-a-prompt-injection-can-control-2mbl