To stop an AI agent from obeying a malicious instruction hidden in an email or webpage, do not rely on a prompt rule alone. Preserve where information came from as it moves through the agent, then have a separate execution layer check every proposed tool action against the user’s intent and the actor’s permissions before it runs.
Why an agent’s context can become a security problem
An agent that can read external material and call tools has a path from information to action. A webpage, file, email, API response, or tool result may contain text that looks like an instruction. If the agent treats that text as authority, it can be steered away from the user’s request.
As an Amazon Associate I earn from qualifying purchases.
NIST’s Center for AI Standards and Innovation (CAISI) described this as agent hijacking in a January 17, 2025 technical blog: “Currently, many AI agents are vulnerable to agent hijacking, a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent, causing it to take unintended, harmful actions.” The blog gives emails, files, and websites as examples of places such instructions may appear.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The risk is not limited to what the agent says. A text response can be wrong; a tool call can send information, change a record, spend money, or affect a system. Security therefore has to cover the route from input to decision to execution—not only the final answer.
#1 Best Overall
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
How provenance follows a request to a tool call
Consider a user who asks an agent to summarize an email. The message includes a hidden instruction to forward sensitive information. A secure design keeps the request, the email content, the agent’s proposed call, and the executor’s decision distinct:
- Record the user’s request. The original intent is to summarize the email, not to forward its contents or obey instructions found inside it.
- Mark the email as external content. Preserve its origin and trust status when it enters the agent’s context. Its text may be relevant to the summary, but it does not become an instruction with the user’s authority.
- Inspect the proposed action. The model may propose a tool call after reading the email. Treat this as a request for execution, not as proof that the user authorized it.
- Make an independent authorization decision. An executor or policy service checks the proposed operation against the original task, the actor’s permissions, the target, and any required approval. It allows or denies the call before execution.
- Keep a decision record. Record the relevant context origins, effective permissions, proposed action, policy result, and approval evidence so the decision can be reconstructed.
This chain helps explain why an action was proposed and gives the enforcement layer the information needed to judge it. It does not require a model to perfectly identify every malicious sentence. OWASP’s Cornucopia guidance describes a similar risk in malicious tool output and recommends separating external data from instructions, screening actions, allowing only appropriate actions, approving high-impact operations, and monitoring.
Why provenance is not authorization
Knowing that a tool call was influenced by an email is useful evidence; it does not by itself determine whether the call is permitted. Likewise, a prompt telling the model to ignore hostile instructions is not an authorization system. OWASP’s AI Agent Security Cheat Sheet states: “This classification does not grant permission to run a tool; the execution component must still check the actor’s authorization and any required approval for the exact action.”
Authorization belongs at an enforcement boundary outside the model’s reasoning: for example, a backend, gateway, service mesh, or tool proxy. That component should deny by default and fail closed if policy, required approval, or audit checks are unavailable. A malformed-call check can reject invalid parameters, but a syntactically valid call may still be unauthorized in its particular context. Agent identity can establish which agent acted; it cannot establish that the action was intended.
Rank #2
- Hardware-Rooted Security with PUF Technology – PUFido Drive Clife Key uses Physical Unclonable Function technology to generate a unique, hardware-based identity that cannot be duplicated, delivering stronger resistance against tampering and cyber attacks than conventional security keys.
- FIDO2 Certified Phishing-Resistant Protection – Fully compliant with FIDO2/U2F standards, enabling secure passwordless login and two-factor authentication to help protect accounts from phishing and credential theft.
- Security Key + Flash Drive in One Device – Combines a FIDO security key with a built-in USB flash drive, allowing you to carry files and a hardware authentication key together in a single compact device.
- Easy to Use & Portable – Compact USB-C design fits easily on a keychain or in a pocket. Simply plug in the Drive Clife Key to authenticate or access stored files with no extra software required.
- Universal Compatibility – Works with hundreds of FIDO2/U2F compatible services and supports Windows, macOS, Linux, iOS, Android, and other major platforms.
For consequential operations, an approval prompt alone is not proof of authorization. The execution layer should independently verify the approval and the actor’s authority for the operation being requested.
Bind permission to the action that will actually run
A broad grant such as “the agent can use email” does not say which message it can send, to whom, or under what task. For a sensitive action, bind the decision to the details the executor can check:
- Actor: the human principal and verified agent identity.
- Operation: the specific tool and action, such as reading a record versus changing it.
- Target and parameters: the resource, recipient, destination, and relevant operation values.
- Task and scope: the user-authorized purpose and the limits of the work.
- Approval and time: any required approval, its status, and its expiry.
Use the least privilege needed, scoped by tool and operation. Short-lived credentials reduce the period in which a grant can be misused; replay protection can prevent an old authorization from being reused where appropriate. Require fresh authorization when the work expands in scope, changes from read to write, crosses a trust boundary, or is delegated to another agent. For destructive, financial, administrative, or externally visible actions, require action-bound approval and step-up authentication where warranted.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to put in the provenance and execution chain
Inputs, retrieval, and memory
Label user input, retrieved documents, API responses, and tool output by origin and trust status. Keep those distinctions intact as content is summarized, retrieved again, placed in memory, or passed between agents. Before persisting information, validate it, isolate sessions, set size and expiry limits, and check for sensitive data. Otherwise, untrusted content can outlive the task or contaminate later context.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Planning and execution
Separate the component that proposes a decision from the component that executes it. The model can request an operation; an external policy service or executor checks scope, privilege, approval, and parameters synchronously before the tool runs. Give each component only the capabilities it needs, and log both the decision and the effective permissions under which it was made.
Approval and failure behavior
Make policy checks, approval validation, and audit requirements part of the execution path—not optional steps in a prompt. If a required check cannot complete, do not execute the action. This reduces the chance that a timeout, missing approval record, or unavailable policy service turns into an implicit grant.
How to compare agent-security designs
These are practical comparison criteria drawn from OWASP controls and NIST’s emphasis on evaluation, not a published scoring framework.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Question | What a stronger design demonstrates |
|---|---|
| Does provenance follow the data? | Origin and trust labels persist through retrieval, memory, tool output, and delegation, rather than being lost when content is transformed. |
| Is enforcement independent of the model? | A separate component makes a synchronous allow-or-deny decision before execution; model text cannot grant itself permission. |
| What does permission authorize? | Grants are scoped to the actor, task, operation, resource, and time, with approval checked for the exact action when required. |
| How are high-impact actions handled? | Destructive, financial, administrative, and externally visible actions receive appropriate action-bound approval and cannot bypass the gate. |
| Can decisions be reproduced? | Tests and records let the team reproduce the relevant conditions and reconstruct what the agent proposed, what it was allowed to do, and why. |
Where CaMeL fits—and what it does not establish
CaMeL is a research architecture that illustrates how to separate risky data from privileged action. A privileged planner prepares a plan without seeing risky documents; a quarantined parser reads untrusted data without tool access; and an interpreter tracks data flow and capability metadata before execution.
Rank #4
![Thetis Pro FIDO2 Security Key Passkey with Complex Pin [PinPlex], Hardware Device Supports USB A, Type C &NFC, TOTP/HOTP Authenticator APP, PIV Certificates, FIDO 2.0 Two Factor Authentication 2FA MFA](https://m.media-amazon.com/images/I/31ugrBqG6SL._SL160_.jpg)
- Dual USB-A and USB-C Security Key – Features both USB-A and USB-C connectors for seamless compatibility across desktops, laptops, and tablets. Supports plug-and-stay use or keychain carry.
- NFC-Enabled for Mobile Access – Built-in NFC allows fast, wireless authentication with Android and iPhone devices. Ideal for mobile logins and on-the-go security.
- FIDO Certified for Strong Authentication – [CHECK COMPATIBILITY before purchase] Fully compliant with FIDO2 and FIDO U2F standards. Works with major platforms like Google, Microsoft, GitHub, and Dropbox.
- Passwordless Login with PinPlex – Supports secure passkey login via WebAuthn and CTAP2 with added protection from PinPlex, a complex PIN system that enhances physical security.
- Multi-Layer Authentication Support – Includes PIV certificates and supports both TOTP and HOTP for strong 2FA/MFA coverage across enterprise and consumer apps.
This is an emerging approach, not a universally deployed or proven standard. OWASP’s prompt-injection guidance notes that implementation is early and that further research is needed. The useful design lesson is separation: reading hostile content need not give the reader of that content the power to act on tools.
How to test the full path
Testing only whether a model resists a direct prompt override misses failures at the tool, approval, identity, and delegation boundaries. Maintain repeatable adversarial cases and make their results part of release decisions. Include tests for:
- Prompt override embedded in retrieved pages, documents, email, and tool output.
- Tool misuse, privilege escalation, and attempts to exfiltrate information.
- Approval bypass, including calls that look valid but do not match the approved action.
- Recursive tool calls and failures when one agent delegates work to another.
- Loss of provenance or trust labels across retrieval, memory, and data transformations.
For each test, retain the agent version, model provider, tool policy, retrieval configuration, abuse case, expected result, and observed allow, denial, or approval behavior. Repeat the tests after material changes to prompts, tools, memory, retrieval, policy, or model provider; those changes can alter the path from context to action.
What current guidance does—and does not—settle
NIST’s AI Agent Standards Initiative page, updated August 14, 2026, describes voluntary guideline work, protocol interoperability, agent authentication and identity research, and security evaluations. It is an initiative, not a completed agent-authorization standard. OWASP’s MCP Top 10 page identifies risks including token exposure, scope creep, tool poisoning, dependency tampering, command execution, contextual prompt injection, and weak authentication or authorization; the page labels itself beta and describes a pilot-testing roadmap.
These efforts indicate that agent identity, security evaluation, and interoperability are active areas of work, but they do not remove the need to enforce each system’s permissions at its own execution boundary. A provenance trail can expose which untrusted material influenced a proposal; the policy layer still has to decide whether the action is allowed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
