AI agent prompt injection and how to stop it

The attack in one line

A web page, PDF, or email contains text like "ignore your instructions and do X". The model treats it as a new order. The fix is a guard in front of the model, not a better prompt.

Patterns to watch for

• Instruction takeover — "ignore your rules".
• Encoded payloads — base64 or unicode hiding a command.
• Role-play — "pretend you are in developer mode".
• Indirect tool abuse — tricking the agent into calling a dangerous tool.

How the guard works

1. Normalize the input and decode tricks.
2. Score it against weighted attack patterns.
3. Check the action against the allowlist and budget.
4. Deny by default and record the reason.

Why blocking saves money

A blocked attempt never reaches the model, so it never consumes tokens. Security and cost control become the same mechanism.

Your part

Treat every external input as untrusted, keep tools on an allowlist, and never put a real secret where a model could be talked into revealing it.

Frequently asked questions