# Prismata: Stopping Cross-Site Prompt Injection > Source: > Published: 2026-07-23 11:07:03+00:00 # Prismata: Stopping Cross-Site Prompt Injection [[email protected]](/cdn-cgi/l/email-protection)," the LLM often just obeys. This is the core of cross-site prompt injection. The Prismata paper tackles this by introducing a confinement layer. Instead of letting the LLM have raw, unfettered access to the agent's capabilities, Prismata acts as a mediator that validates whether the "instruction" coming from a webpage is actually a legitimate request or a malicious injection. ## How the Confinement Works The system doesn't just rely on better prompting (which is easily bypassed). Instead, it implements a structural boundary: 1. **Context Separation:** It distinguishes between the user's intent and the data retrieved from the external site. 2. **Capability Gating:** Before an action is executed (like sending an email or deleting a file), Prismata checks if that action was triggered by the user's original goal or by a prompt found on the page. 3. **Verification Loop:** It forces a verification step for high-risk actions, ensuring the "instruction" didn't originate from an untrusted DOM element. This is a much more robust approach than trying to "prompt engineer" the safety out of the model. In a real-world AI workflow, you can't trust any HTML you scrape. Treating every external page as a potential adversary is the only way to deploy these agents safely. For anyone building LLM agents that interact with the open web, this paper is a solid deep dive into why traditional sandboxing isn't enough for prompt-based logic. `https://arxiv.org/abs/2607.08147` [Next DNS Exfiltration via macOS Terminal ANSI Codes →](/en/threads/2238/) ## All Replies （0） No replies yet — be the first!