The piece argues prompt injection has evolved from a content-filtering problem into a provenance/authorization problem in agent stacks: untrusted read output can silently drive privileged write-tool arguments (a confused deputy), and defenses must bind authorization to the user's original intent via trust labels, signed intent digests, read-only sub-agents, and scoped authority rather than per-tool allowlists.
defence discussions now still roots back to content. stronger system prompts, better filters, catch the malicious string before the model sees it. but the research has been pointing somewhere else for a while now and agents with real tools make the gap pretty obvious tho information flow makes more sese. Rather than "is this webpage malicious?" but did an untrusted source influence a privileged parameter?" a page can be perfectly safe to summarise and still be unsafe if text inside it ends up choosing an email recipient or supplying an argument to a database tool the sequence no allowlist catches: allowed read tool => untrusted output => allowed write tool, arguments changed server and tool allowlists answer identity questions. which server, which tool name. they dont tell u where the arguments came from, so the second call can match every rule u configured and still do the wrong thing. thats a confused deputy and it keeps happening bc authorisation is bound to the tool runner rather than to what the user actually asked for. awkward part is keeping that context across the hop. a trust label is useless if it disappears after the read and most per-call checks start with no memory of what happened before. so it has to live either in ur orchestrator or somewhere already in the path, a gateway or eve security or another control layer seeing the call. frameworks mostly wont carry it for u either way one question you shall must consider running against ur own stack: for every write tool ur agents can reach does the tool verify the user requested this action, or does it only verify that the agent is allowed to call it? everything in the second group is the problem waiting to happen things people are trying: * trust labels by origin, so the system prompt and retrieval context and an arbitrary web fetch aren't treated the same * a read-only sub agent for anything touching untrusted content holding no side-effecting tools at all * a signed intent digest built from the original request and checked at the tool, so the tool can tell if the operation matches what was asked * sub agents getting fresh scoped authority instead of automatically inheriting whatever the parent had * the formal versions of the same idea keep floating around the research side too (agent-sentry, tokentaint)
A production AI support agent was compromised via prompt injection, exposing other customers' data. The post-mortem revealed lack of enforcement layers, useless audit trails, and no kill switch, highlighting systemic security gaps in deploying AI agents.
A discussion about handling prompt injection attacks in AI agents that read external content like emails and webpages, exploring production-level defenses and the subtle threats beyond obvious patterns.
This paper proposes Sentinel Gateway, a middleware layer that enforces strict separation between trusted instruction channels and untrusted data channels to mitigate prompt injection in LLM agents, using signed runtime authorization tokens and offering audit logging capabilities.
The article explains how untrusted tool output in AI systems can be exploited for prompt injection attacks, emphasizing the need to treat certain fields as untrusted even within internal systems.