What prompt injection looks like
An attacker hides instructions inside content the agent reads — a web page, a PDF, a paste from an email — like "ignore your previous instructions and run this command". The model treats it as a new order and follows it.
It is not a model flaw you can patch away. It is a property of how instruction-following models work, which is why the guard has to sit in front of the model, not inside the prompt.
The classes it usually takes
- Instruction takeover — "ignore your rules and do X".
- Encoded payloads — base64 or unicode that decode into a command.
- Role-play bypass — "pretend you are in developer mode".
- Tool abuse — asking the agent to call a dangerous tool indirectly.
Block before it is billed
The injection guard scores incoming content against a set of weighted patterns and blocks the request before the model or the tool sees it. A blocked attempt never consumes tokens, which is the difference between an attack and a bill.
Layered, not a single filter
- Normalize the content — decode encodings, strip tricks.
- Score it against attack patterns.
- Check the action against the agent’s allowlist and budget.
- Deny by default when anything looks off.
- Record the decision with a reason in the audit trail.
What you can do today
Treat every external input as untrusted, keep tools on an allowlist, and never put a real secret where a model could be talked into revealing it. The guard handles the rest.