{"slug": "prismata-stopping-cross-site-prompt-injection", "title": "Prismata: Stopping Cross-Site Prompt Injection", "summary": "A new paper introduces Prismata, a confinement layer that prevents cross-site prompt injection attacks on LLM agents by validating instructions from webpages before executing actions. The system implements context separation, capability gating, and a verification loop to distinguish user intent from malicious prompts embedded in external sites. The approach is presented as more robust than prompt engineering for securing AI agents that interact with the open web.", "body_md": "# Prismata: Stopping Cross-Site Prompt Injection\n\n[[email protected]](/cdn-cgi/l/email-protection),\" the LLM often just obeys. This is the core of cross-site prompt injection.\n\nThe Prismata paper tackles this by introducing a confinement layer. Instead of letting the LLM have raw, unfettered access to the agent's capabilities, Prismata acts as a mediator that validates whether the \"instruction\" coming from a webpage is actually a legitimate request or a malicious injection.\n\n## How the Confinement Works\n\nThe system doesn't just rely on better prompting (which is easily bypassed). Instead, it implements a structural boundary:\n\n1. **Context Separation:** It distinguishes between the user's intent and the data retrieved from the external site.\n\n2. **Capability Gating:** Before an action is executed (like sending an email or deleting a file), Prismata checks if that action was triggered by the user's original goal or by a prompt found on the page.\n\n3. **Verification Loop:** It forces a verification step for high-risk actions, ensuring the \"instruction\" didn't originate from an untrusted DOM element.\n\nThis is a much more robust approach than trying to \"prompt engineer\" the safety out of the model. In a real-world AI workflow, you can't trust any HTML you scrape. Treating every external page as a potential adversary is the only way to deploy these agents safely.\n\nFor anyone building LLM agents that interact with the open web, this paper is a solid deep dive into why traditional sandboxing isn't enough for prompt-based logic.\n\n`https://arxiv.org/abs/2607.08147`\n\n[Next DNS Exfiltration via macOS Terminal ANSI Codes →](/en/threads/2238/)\n\n## All Replies （0）\n\nNo replies yet — be the first!", "url": "https://wpnews.pro/news/prismata-stopping-cross-site-prompt-injection", "canonical_source": "https://promptcube3.com/en/threads/2254/", "published_at": "2026-07-23 11:07:03+00:00", "updated_at": "2026-07-23 19:07:56.022003+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-agents"], "entities": ["Prismata"], "alternates": {"html": "https://wpnews.pro/news/prismata-stopping-cross-site-prompt-injection", "markdown": "https://wpnews.pro/news/prismata-stopping-cross-site-prompt-injection.md", "text": "https://wpnews.pro/news/prismata-stopping-cross-site-prompt-injection.txt", "jsonld": "https://wpnews.pro/news/prismata-stopping-cross-site-prompt-injection.jsonld"}}