Prompt injection and trust boundaries

Direct injection arrives through an interaction controlled by the user; indirect injection arrives through a lower-trust source such as a retrieved passage, web page, or tool response. Original research demonstrates that an AI application can treat this supplied content as instructions. Describe the issue through source and authority rather than a list of forbidden phrases: benign documents may quote instructions, while malicious content can be phrased in many ways.

Annotate the provenance of each context item and keep trusted instructions distinct from quoted material where supported. Clear formatting, constrained tasks, and training can improve behavior but should not be described as complete isolation. A language model still processes the content. Do not put secrets in its context merely because an instruction tells it not to disclose them; reduce accessible information to the current task and caller's permissions.

Use typed tool arguments, explicit allowlists where suitable, resource-scoped credentials, and destination checks. Validate on the server using an authenticated user identity, not a name asserted in model output. Separate read-only analysis from write actions and require an appropriate approval path for consequential changes. An approval must show the actual effect and remain bound to those parameters through execution, retries, and any asynchronous worker.

A retrieval service should enforce document access before returning passages. A sending service should independently enforce who may send which object to which destination. These separate gates reduce the chance that a single model error becomes an external effect. They do not settle every risk: an authorized user may still request a harmful action, and a plausible summary can mislead a reviewer. Keep semantic review, privacy rules, and operational authorization distinct.

Build a defensive test suite spanning document formats, languages, multi-step tasks, retrieved metadata, and tool responses. Record success as a concrete security consequence, such as an unauthorized read or write, rather than whether the model repeats a suspicious phrase. Run tests in an isolated environment with synthetic private data and inert tool implementations. Include ordinary tasks to measure whether defenses make the assistant unusable.

Report the model version, prompts, tool schema, permission policy, test distribution, and uncertainty. A classifier that catches a known corpus is an additional signal, not a proof against adaptive inputs. Conditional evaluation can reveal whether a downstream authorization gate still works when the model is deliberately induced to propose an invalid action. That test supports a narrower and more useful claim than announcing that prompt injection has been solved.