Prompt injection has topped the OWASP Top 10 for LLM Applications since the list began, and in the latest edition excessive agency has climbed close behind. That ordering tells the story of 2026: models are no better at telling instructions from data, and we keep giving them more power.
OWASP's separate Top 10 for Agentic Applications puts agent goal hijack at number one. Here is how we threat-model and defend AI features for clients.
The threat model in one paragraph
An LLM can't reliably distinguish your instructions from text it reads. If your feature puts untrusted content (emails, web pages, uploaded files, tickets, product reviews, code) into the context, that content can steer the model. Whatever the model can do, an attacker can now try to make it do.
The lethal trifecta
Simon Willison's framing is the most useful test we know. An agent is at serious risk when it has all three of:
- Access to private data (your CRM, the user's inbox, internal docs)
- Exposure to untrusted content (anything a third party can write)
- A way to communicate externally (send email, call webhooks, render images from URLs, create public links)
Remove any one leg and the most damaging attack, data exfiltration, becomes much harder. Most of the defences below are ways of cutting a leg.
Defence 1: least privilege, per run
- Give each tool the narrowest credential possible: this tenant, this user, this action
- Prefer read-only tools; make write tools explicit and few
- Issue short-lived, scoped tokens per agent run instead of a shared service key
- Never let the model choose which credentials to use
Defence 2: isolate untrusted content
- Process untrusted documents in a separate, tool-less model call that returns structured data (for example
{ "invoice_total": 120.5 }), not free text that flows back into the privileged agent - This is the dual-LLM pattern. Research such as Google DeepMind's CaMeL formalises it with a privileged planner and a quarantined reader
- Strip or neutralise active content: hidden HTML, zero-width characters, markdown image URLs
Defence 3: control the exits
- Block or allow-list outbound URLs, including markdown image rendering, a classic exfiltration channel
- No arbitrary webhooks or email recipients chosen by the model
- Add egress rules at the network level for agent sandboxes
Defence 4: humans approve the irreversible
- Payments, deletions, external messages, permission changes and anything else hard to undo need explicit confirmation, with a clear preview of what will happen
- Show the user the source that triggered the action ("this request came from an external email")
- Log approvals for audit. This also helps with AI Act transparency
Defence 5: detect and monitor
- Input and output classifiers (guardrail models) as a noise filter
- Alerts on anomalous tool sequences, such as read-secret followed by an outbound call
- Full traces of every run, as described in our agent architecture guide
Defence 6: red-team in CI
Build an attack eval set and run it on every prompt, tool or model change:
- Direct injections ("ignore previous instructions…")
- Indirect injections hidden in documents, HTML comments and image alt text
- Tool-abuse scenarios: can a ticket convince the agent to refund itself?
- Data-exfiltration attempts through every outbound channel
The OWASP prompt injection prevention cheat sheet is a good source of test cases.
MCP and third-party tools
Connecting third-party MCP servers widens the attack surface. Tool descriptions themselves can carry injected instructions ("tool poisoning"). Pin versions, review tool descriptions, and don't mix untrusted servers with privileged ones in the same agent.
A quick self-assessment
| Question | Good answer |
|---|---|
| Can untrusted text reach a model that has write tools? | No, or only through a quarantined parser |
| Can the agent send data to a URL it chose? | No |
| Are destructive actions confirmed by a human? | Yes, with a preview |
| Do tools use per-user, scoped credentials? | Yes |
| Do we run injection evals in CI? | Yes, on every change |
Bottom line
You can't prompt your way out of prompt injection. You design your way out, so that a fooled model has nothing dangerous within reach.
Our AI integration team runs security reviews and red-team evals for LLM features and agents. Get in touch or see how a sprint works.
Frequently asked questions
Can prompt injection be fully prevented?
Not with today's models. No prompt or filter reliably stops it, so design the system so that a successful injection can't cause serious harm: limit privileges, isolate untrusted content and require approvals for risky actions.
What is the lethal trifecta?
A term popularised by Simon Willison for agents that combine access to private data, exposure to untrusted content and the ability to communicate externally. Any agent with all three can be tricked into leaking data.
What is indirect prompt injection?
Malicious instructions hidden in content the model reads, such as a web page, email, PDF, ticket or code comment, rather than typed by the user. It's the main risk for agents that browse or read inboxes.
Do guardrail models stop prompt injection?
They reduce noise and catch obvious attacks, so they're worth having as one layer, but determined attackers bypass them. Treat them as detection, not prevention.