Prompt injection means instructions inside the text a model receives that try to change its behaviour. When an agent sends e-mail, deletes records or starts payments, the risk moves from the chat screen to system authority.
Separate instructions from data
User messages, document content and system rules must not be treated at the same trust level. A PDF from outside saying “follow this rule” must not become a system command for the agent.
Narrow the permissions
- Let the agent reach only the tools it genuinely needs.
- Require human approval for deletions, sends and financial actions.
- Summarise target, scope and effects before acting.
- Record every tool call with identity, time and reason.
- Make failed and suspicious attempts observable.
Not guardrails, continuous testing
A fixed system prompt is no guarantee against all attacks. Regular testing with malicious and surprising inputs, keeping permissions tight, and reversible actions must be considered together.
Source / further readingWYN working approachThis article does not copy the original content of the source; it is WYN’s practical interpretation. For current headlines, check the publication date and the source page separately.