Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAn AI agent does not literally execute a substring. The failure happens when an agent with tools mistakes text that should be data—a question, quotation, fetched page, document, or tool result—for an instruction, then uses its authority to act on that interpretation. This is a form of prompt injection and instruction/data confusion. Preventing harm requires controls around the agent’s tools and permissions, not just better delimiters or filters.
How a question or quote can influence an agent
A language model processes text in context, but an application must distinguish instructions it is authorized to follow from text it is meant to inspect. If that distinction is unclear, a quoted command or an instruction embedded in external content may influence the model’s next step.
As an Amazon Associate I earn from qualifying purchases.
Direct and indirect prompt injection
Direct prompt injection comes from content supplied as part of a user’s interaction. Indirect prompt injection arrives through material the agent retrieves or receives from another source, such as a web page, file, API response, or tool output. The person who started the task may not have written or even seen that content. OWASP’s Cornucopia AAI7 guidance describes the risk of treating tool output as authoritative instead of as untrusted external data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For example, imagine an agent asked to summarize a web page. The page contains hidden or visible text telling the agent to send information elsewhere. If the agent treats that text as a command and has a messaging tool available, the retrieved content has influenced an action beyond summarization. This is an illustrative threat model, not evidence of a particular real-world incident.
#1 Best Overall
Why tool access changes the stakes
A mistaken interpretation is more consequential when the agent can act. An agent limited to reading and summarizing has a smaller impact surface than one that can send messages, change records, or access broad resources. OWASP’s excessive-agency guidance identifies unnecessary functionality, permissions broader than the task requires, and too much autonomy as common contributors to risk. See the OWASP 2025 excessive-agency entry and the OWASP Agentic Top 10 for 2026.
Why delimiters and filters are not security boundaries
Quotation marks, XML-style tags, labels such as “untrusted text,” and other delimiters can help organize context. Screening can catch some known malicious patterns. Neither measure, by itself, guarantees that a model will ignore an instruction embedded in data. OWASP notes that pattern-based filters do not reliably catch indirect injection and recommends enforcing permissions and validating proposed tool arguments outside the model. See OWASP’s prompt-injection guidance.
Rank #2
OWASP Cornucopia states: “Tool output must be treated as untrusted external data and handled with the same caution applied to any other user-supplied input.” That principle applies to retrieved pages and files as well as to results returned by APIs or other tools.
Controls that limit what an agent can do
Use several layers, but give the strongest security responsibilities to components that can enforce rules regardless of what the model says.
Rank #3
1. Preserve the boundary between instructions and data
Label untrusted material, delimit it where useful, and retain its source or provenance. Make clear in the application’s context that retrieved text and tool output are content to analyze, not authority to change the task. These practices help the model interpret context, but they do not replace authorization checks.
2. Give the agent only the tools and permissions it needs
Expose task-specific functions and narrow resource access rather than open-ended capabilities. A summarization task generally does not need permission to send messages or update records. Limiting available actions reduces the damage possible if untrusted content influences the agent.
Rank #4
3. Check every proposed action outside the model
At the execution boundary, validate the actor, tool, target, and normalized parameters immediately before any side effect. The component performing the action—not the model’s own claim that an action is safe—should enforce the policy. For high-impact or irreversible operations, require approval tied to the exact action and its parameters; a broad, reusable approval may not cover what the agent is actually about to do.
4. Use screening as an additional layer
Input and output checks may help detect known attacks or information leakage. Treat them as supplemental: filters and guardrail models can miss attacks and should not stand in for access control or execution-time authorization.
5. Test the full path
Include adversarial content from retrieved pages, files, API responses, and tool results in testing. Record the agent version and policies tested, the expected behavior, and whether proposed actions were approved or denied. Testing only the initial user prompt misses the routes through which indirect injection can arrive.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to judge a claimed defense
Defense approaches operate at different points and constrain different things. A context label affects how data is presented; a filter screens content; tool permissions restrict available functions or resources; execution-time authorization checks a specific action; human approval adds a decision point for selected operations. These measures are not interchangeable. In particular, screening does not provide the same guarantee as a policy enforced by the component that executes a tool call.
Claims about defenses also need their evaluation context. The AttriGuard authors reported a 0% attack success rate under static attacks across four LLMs and two agent benchmarks on the USENIX Security 2026 presentation page. That is a result for the described evaluation, not proof that the method—or any agent—is immune to other attacks, settings, or content.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What the evidence does not establish
The guidance supports a general explanation of how instruction/data confusion can lead to unauthorized tool actions. It does not identify the agent in the title or verify a particular incident, product, or agent’s behavior. OWASP Cornucopia AAI7 reports a last update of 20 September 2026 and maps the scenario to OWASP LLM Top 10 LLM01:2026 and Agentic Top 10 ASI02:2026; guidance can change, so consult the linked live material when making implementation decisions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
